PS; PHP version is actually 7.4.0, but it's not available in the dropdown list
PPS: the second URL (used to actually stop the debugging session) is http://my.site/?XDEBUG_SESSION_STOP_NO_EXEC=ECLIPSE_DBGP&KEY=15754677630784

I've fixed the warning through https://github.com/xdebug/xdebug/pull/539, and I can indeed reproduce your problem. For some reason, although Xdebug sets the cookie with PHPs internal php_setcookie function, it never makes it into the headers that are sent out. That's going to take more investigation.

However, I would recommend that instead of these two GET/POST parameters, you use one of the browser extensions to activate an Xdebug session instead: https://xdebug.org/docs/remote#browser-extensions — that way, you can click on an icon in your browser without having to press "Go" in your IDE.

I just updated to xdebug 2.9.2 and the issue is still there:

C:>php -v
PHP 7.4.2 (cli) (built: Jan 21 2020 17:53:48) ( ZTS Visual C++ 2017 x86 )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
with Xdebug v2.9.2, Copyright (c) 2002-2020, by Derick Rethans

When browsing to my local development server to stop the Xdebug session (eg to http://localhost:11031/?XDEBUG_SESSION_STOP_NO_EXEC=ECLIPSE_DBGP&KEY=15807217074863) the browser sends this request:

GET http://localhost:11031/?XDEBUG_SESSION_STOP_NO_EXEC=ECLIPSE_DBGP&KEY=15807217074863 HTTP/1.1
Host: localhost:11031
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Accept-Language: it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: XDEBUG_SESSION=ECLIPSE_DBGP

And the server still answers with

HTTP/1.1 200 OK
Date: Mon, 03 Feb 2020 10:11:55 GMT
Server: Apache/2.4.37 (Win32) OpenSSL/1.1.1a PHP/7.4.2
X-Powered-By: PHP/7.4.2
Content-Length: 117
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Warning: Header may not contain NUL bytes in Unknown on line 0

DEBUG SESSION ENDED

As you can see, the cookie is not deleted, and the warning is still there.

i'm having the same problem in xdebug 3.0.4 (php_xdebug-3.0.4-7.4-vc15-x86_64.dll):

$ ./php -v
PHP 7.4.18 (cli) (built: Apr 27 2021 17:17:20) ( ZTS Visual C++ 2017 x64 )
Copyright (c) The PHP Group
Zend Engine v3.4.0, Copyright (c) Zend Technologies
with Xdebug v3.0.4, Copyright (c) 2002-2021, by Derick Rethans

It seems that the XDEBUG_SESSION_STOP_NO_EXEC Get/Post parameter is no longer valid. Instead, we should use the XDEBUG_SESSION_STOP.
But, users of Netbeans or Eclipse can't change the parameter name that IDE uses to end debug sessions.
Can you solve this bug alowing again the parameter XDEBUG_SESSION_STOP_NO_EXEC? It has to work as the XDEBUG_SESSION_STOP param.

With XDebug V2 this was working without problems :(

The workaround for me, every time I need to finish a debug session is: Change de URL opened by Netbeans IDE to close debug session and change the param XDEBUG_SESSION_STOP_NO_EXEC to XDEBUG_SESSION_STOP

https://localhost/?XDEBUG_SESSION_STOP_NO_EXEC=netbeans-xdebug

That makes XDebug delete the XDEBUG_SESSION Cookie.

I don't think I will be spending more time on this. These extra GET parameters were always a workaround for IDEs that don't really play nice with the way how the debugger works.