SSRF via null-byte hostname truncation

SSRF in fsockopen() in The PHP Group PHP allows attackers to connect to unintended hosts through null-byte hostname truncation. The stream transport passes the hostname to lower-level address resolution without rejecting embedded nulls, so resolution stops before the suffix that a length-aware parser checks. Exploitation requires application code to validate an attacker-controlled host with different parsing semantics and then pass the same value to fsockopen().