{"id":"CVE-2019-11043","kind":"vulnerability","aliases":["CVE-2019-11043"],"related":[],"title":"PHP FastCGI Process Manager (FPM): PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability","description":"In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.","summary":"PHP-FPM env_path_info underflow (fpm_main.c) lets a remote attacker write past buffers and run code. It is reachable only when php-fpm sits behind nginx with a vulnerable location block. Affects PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24 and 7.3.x before 7.3.11. Gentoo also lists 5.6 as affected, with a distro backport. A public exploit exists and the flaw is exploited in the wild.","severity":"critical","cvss":9.8,"epss":0.99748,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"PHP FastCGI Process Manager (FPM)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"PHP","fixed":["7.1.33","7.2.24","7.3.11"],"affected":">= 7.1.0, < 7.1.33; >= 7.2.0, < 7.2.24; >= 7.3.0, < 7.3.11 (FPM behind nginx)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","nginx","php","php-fpm","ransomware","runtime","self-hosted"],"not_affected_if":["apache","default-config","managed-hosting","php-7.4-or-later","php-cgi-not-fpm","try-files-check"],"how_to_check":"Run php -v and php-fpm -v: vulnerable if 7.1 < 7.1.33, 7.2 < 7.2.24 or 7.3 < 7.3.11 (distro builds may be backported, so check the package changelog for CVE-2019-11043). Then run nginx -T and look for a PHP location block with 'fastcgi_split_path_info ^(.+?\\.php)(/.*)$;' plus 'fastcgi_param PATH_INFO $fastcgi_path_info;' and no try_files $uri =404 or if (-f $uri) check. You are exposed if both the version and the config match.","fix":"Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later; 7.4 and newer are not listed as affected. If you cannot patch yet, add 'try_files $fastcgi_script_name =404;' (or an equivalent file-existence check) before the fastcgi_pass in the PHP location block, so nginx drops requests for scripts that do not exist.","status":"open","published_at":"2019-10-28T15:15:13+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:03+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-10-23T21:20:03Z","model":"claude-haiku-5-5","output":{"fix":"Apply the PHP update per vendor instructions; the specific fixed version is unknown from the sources.","reach":"internet","impact":"high","summary":"PHP FPM can write past allocated buffers when run in certain configurations, a memory corruption flaw. An attacker sending crafted requests can get remote code execution on the server.","category":"runtime","who_cares":["php","php-fpm","nginx","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker runs code on the PHP server","analyst_note":"Find the affected and fixed PHP versions and the exact FPM configuration trigger from the CVE-2019-11043 NVD or PHP security advisory; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config","php-cgi-not-fpm"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000454,"input_tokens":2867,"output_tokens":335,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the affected and fixed PHP versions and the exact FPM configuration trigger from the CVE-2019-11043 NVD or PHP security advisory; the sources give neither.","search":"'-11043':16A,19A '-2019':15A,18A '5.6':90B '7.1':74B,112C '7.1.33':77B,115C '7.2':78B,116C '7.2.24':81B,119C '7.3':83B,121C '7.3.11':86B,124C 'affect':72B,92B 'alloc':141C 'also':88B 'attack':49B 'backport':96B 'behind':65B 'block':71B 'buffer':11A,52B,142C 'caus':135C 'certain':126C 'code':55B,157C 'configur':127C 'cve':14A,17A 'data':150C 'distro':95B 'env':40B 'execut':158C 'exist':100B 'exploit':26B,99B,105B 'fastcgi':2A,7A,21A 'fcgi':148C 'flaw':103B 'fpm':5A,10A,24A,31B,39B,44B,63B,129C,136C 'gentoo':87B 'host':36B 'info':42B 'let':46B 'list':89B 'locat':70B 'main.c':45B 'manag':4A,9A 'manager':23A 'modul':137C 'nginx':27B,66B 'open':152C 'overflow':12A 'past':51B,140C 'path':41B 'php':1A,6A,20A,25A,28B,30B,38B,62B,73B,110C 'php-fpm':29B,37B,61B 'possibl':133C,154C 'process':3A,8A,22A 'protocol':149C 'public':98B 'ransomwar':32B 'reachabl':58B 'remot':48B,156C 'reserv':146C 'run':54B 'runtim':33B 'self':35B 'self-host':34B 'setup':130C 'sit':64B 'space':145C 'thus':151C 'underflow':43B 'version':111C 'vulner':13A,69B 'wild':108B 'write':50B,139C 'x':75B,79B,84B,113C,117C,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-10-28T15:15:13+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security@php.net","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2019-11043","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11043","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2019-11043","url":"https://api.first.org/data/v1/epss?cve=CVE-2019-11043","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2019-11043:55","url":null,"severity":null,"published_at":"2026-10-23T21:20:36+00:00","modified_at":"2026-10-23T21:20:36+00:00","first_seen_at":"2026-10-23T21:20:36+00:00","fetched_at":"2026-10-23T21:20:36+00:00","note":"Read CVE record, PHP bug 78599, Red Hat, php-src NEWS and the public PoC. Affected/fixed versions and the nginx trigger are now documented. KEV lists it as exploited; PoC phuip-fpizdam is public."},{"source":"nvd","external_id":"CVE-2019-11043","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11043","severity":null,"published_at":"2019-10-28T15:15:13+00:00","modified_at":"2026-06-17T02:12:11+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":945,"url":"https://www.cve.org/CVERecord?id=CVE-2019-11043","title":"CVE Record CVE-2019-11043 (PHP Group)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":946,"url":"https://bugs.php.net/bug.php?id=78599","title":"PHP Sec Bug #78599 env_path_info underflow","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":947,"url":"https://github.com/neex/phuip-fpizdam","title":"phuip-fpizdam exploit and preconditions","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":948,"url":"https://access.redhat.com/security/cve/cve-2019-11043","title":"Red Hat CVE-2019-11043 (mitigation)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":949,"url":"https://github.com/php/php-src/blob/PHP-7.1/NEWS","title":"PHP 7.1 NEWS: 7.1.33 fix","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}