Medium
Security advisory
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-7071
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:26 UTC · Revision 1
Source evidence
In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.
osv:CVE-2020-7071
Complete source record
{
"id": "8b7ef64bfce486fe94795da7cf9a1b92669e14ec0dfc25622c2e569cb94dee84",
"url": "https://osv.dev/vulnerability/CVE-2020-7071",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-7071",
"summary": "In PHP versions 7.3.x below 7.3.26, 7.4.x below 7.4.14 and 8.0.0, when validating URL with functions like filter_var($url, FILTER_VALIDATE_URL), PHP will accept an URL with invalid password as valid URL. This may lead to functions that rely on URL being valid to mis-parse the URL and produce wrong data as components of the URL.",
"evidence": "osv:CVE-2020-7071",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-7071",
"aliases": [
"BIT-libphp-2020-7071",
"BIT-php-2020-7071",
"BIT-php-min-2020-7071",
"CVE-2020-7071"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/php/php-src",
"type": "GIT",
"events": [
{
"introduced": "52ace952a1b65ca80fc2617f11c2fa6dd03f51bd"
},
{
"fixed": "d4f5aed22193106271510efd643ba8f349b7d85f"
},
{
"introduced": "3c7824e16ec4c3cee417262445d2c2b66531c10f"
},
{
"fixed": "8e9d39f15c04a806c5a481d53f384955f9dec718"
},
{
"introduced": "5dc92c2117cafc61daaaaa240fd46c3ac33872a4"
},
{
"fixed": "94d96b3c979a60e47abe209506c3947a16abff40"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"fixed": "7.3.26"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"fixed": "7.4.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.1"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7071.json",
"vanir_signatures": [
{
"id": "CVE-2020-7071-bd47661d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"227590726783538602739410841003471904793",
"66680938880302284338338960787911270257",
"171183897526155539642673019964330521437",
"148221363525494540717156201398603599226",
"14027080294252728254363174975924474113",
"76883004995448503163927027256011056830",
"64543593176252355754339515403925011044",
"12108129512617529725365468371233867917",
"100947579209271428937666099495064218656",
"101484631618889424068088575429425243002",
"283402044833093694227510714613320421908"
]
},
"source": "https://github.com/php/php-src/commit/d4f5aed22193106271510efd643ba8f349b7d85f",
"target": {
"file": "ext/standard/url.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-7071-fe94b820",
"digest": {
"length": 4481,
"function_hash": "104833949699379374291448524444507709786"
},
"source": "https://github.com/php/php-src/commit/d4f5aed22193106271510efd643ba8f349b7d85f",
"target": {
"file": "ext/standard/url.c",
"function": "php_url_parse_ex2"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:24:34Z"
}
}
],
"modified": "2026-10-24T14:24:34.639527242Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2021/07/msg00008.html",
"https://security.gentoo.org/glsa/202105-23",
"https://security.netapp.com/advisory/ntap-20210312-0005/",
"https://www.debian.org/security/2021/dsa-4856",
"https://www.tenable.com/security/tns-2021-14",
"https://bugs.php.net/bug.php?id=77423",
"https://www.oracle.com/security-alerts/cpuoct2021.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-7071",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443702,
"published_at": "2021-02-15T04:15:12.563+00:00"
}