Live › vulnerability › CVE-2019-11043
Go to dashboardPHP-FPM env_path_info underflow (fpm_main.c) lets a remote attacker write past buffers and run code. It is reachable only when php-fpm sits behind nginx with a vulnerable location block. Affects PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24 and 7.3.x before 7.3.11. Gentoo also lists 5.6 as affected, with a distro backport. A public exploit exists and the flaw is exploited in the wild.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| PHP FastCGI Process Manager (FPM) | vendor | – | – |
| PHP | vendor | >= 7.1.0, < 7.1.33; >= 7.2.0, < 7.2.24; >= 7.3.0, < 7.3.11 (FPM behind nginx) | 7.1.33, 7.2.24, 7.3.11 |
php -v and php-fpm -v: vulnerable if 7.1 < 7.1.33, 7.2 < 7.2.24 or 7.3 < 7.3.11 (distro builds may be backported, so check the package changelog for CVE-2019-11043)fastcgi_split_path_info ^(.+?\.php)(/.*)$; plus fastcgi_param PATH_INFO $fastcgi_path_info; and no try_files $uri =404 or if (-f $uri) check7.1.33, 7.2.24, 7.3.11 or later; 7.4 and newer are not listed as affectedtry_files $fastcgi_script_name =404; (or an equivalent file-existence check) before the fastcgi_pass in the PHP location block, so nginx drops requests for scripts that do not existEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2019-11043")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.