CVE-2020-7066: URL Truncation in PHP 7.4

The primary impact of CVE-2020-7066 lies in the potential for attackers to manipulate the target of getheaders() requests. By injecting zero characters into a user-controlled URL passed to getheaders(), an attacker can truncate the URL, effectively changing the destination. This could lead to sensitive data being sent to an attacker-controlled server instead of the intended recipient. For example, an application using getheaders() to verify the legitimacy of a URL might be tricked into accepting a malicious URL due to the truncation. The blast radius is dependent on the application's usage of the getheaders() function and the sensitivity of the data being handled. While not a direct remote code execution vulnerability, the misdirection of requests can have significant consequences depending on the application's functionality.

1. Reserved2020-01-15
2. Published2020-04-01
3. Modified2024-09-17
4. EPSS updated2026-04-02

The recommended mitigation for CVE-2020-7066 is to upgrade to PHP version 7.4.4 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing input validation on URLs passed to getheaders(). Specifically, sanitize user-supplied URLs to remove or escape zero characters (\0). Web application firewalls (WAFs) can be configured to detect and block requests containing suspicious URL patterns. Additionally, review application code that utilizes getheaders() to ensure proper error handling and validation of the returned headers to prevent unexpected behavior. After upgrading, confirm the fix by attempting to use get_headers() with a URL containing a zero character; the URL should not be truncated.