CVE-2020-7071

In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "introduced":  "9.0"
                },
                {
                    "last_affected":  "9.0"
                },
                {
                    "introduced":  "10.0"
                },
                {
                    "last_affected":  "10.0"
                }
            ],
            "source":  "CPE_STRING",
            "vendor_product":  "debian:debian_linux"
        }
    ]
}

References

Affected packages

Git / github.com/php/php-src

Affected ranges

Type

GIT

Repo

https://github.com/php/php-src

Events

Introduced

52ace952a1b65ca80fc2617f11c2fa6dd03f51bd

Fixed

d4f5aed22193106271510efd643ba8f349b7d85f

Introduced

3c7824e16ec4c3cee417262445d2c2b66531c10f

Fixed

8e9d39f15c04a806c5a481d53f384955f9dec718

Introduced

5dc92c2117cafc61daaaaa240fd46c3ac33872a4

Fixed

94d96b3c979a60e47abe209506c3947a16abff40

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "7.3.0"
        },
        {
            "fixed":  "7.3.26"
        },
        {
            "introduced":  "7.4.0"
        },
        {
            "fixed":  "7.4.14"
        },
        {
            "introduced":  "8.0.0"
        },
        {
            "fixed":  "8.0.1"
        }
    ],
    "source":  "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7071.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "227590726783538602739410841003471904793",
                "66680938880302284338338960787911270257",
                "171183897526155539642673019964330521437",
                "148221363525494540717156201398603599226",
                "14027080294252728254363174975924474113",
                "76883004995448503163927027256011056830",
                "64543593176252355754339515403925011044",
                "12108129512617529725365468371233867917",
                "100947579209271428937666099495064218656",
                "101484631618889424068088575429425243002",
                "283402044833093694227510714613320421908"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-7071-bd47661d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/d4f5aed22193106271510efd643ba8f349b7d85f",
        "target":  {
            "file":  "ext/standard/url.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "104833949699379374291448524444507709786",
            "length":  4481
        },
        "id":  "CVE-2020-7071-fe94b820",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/php/php-src/commit/d4f5aed22193106271510efd643ba8f349b7d85f",
        "target":  {
            "file":  "ext/standard/url.c",
            "function":  "php_url_parse_ex2"
        }
    }
]

vanir_signatures_modified

"2026-08-07T15:14:44Z"