CVE-2020-7070: PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-10-02 · updated 2026-06-17
Weakness: CWE-20

Description

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like __Host confused with cookies that decode to such prefix, thus leading to an attacker being able to forge cookie which is supposed to be secure. See also CVE-2020-8184 for more information.

Affected products

Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 20.04
Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 31, 32, 33
Clustered Data ONTAP: all versions
openSUSE Leap: 15.1, 15.2
PHP: from 7.2.0 before 7.2.34; from 7.3.0 before 7.3.23; from 7.4.0 before 7.4.11 — fixed in 7.2.34, 7.3.23, 7.4.11
Tenable.sc: before 5.19.0 — fixed in 5.19.0

How to fix

Upgrade to a fixed version: PHP 7.2.34, 7.3.23, 7.4.11; Tenable.sc 5.19.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-7070 or the next vulnerability affects your stack