---
id: "CVE-2019-11043"
kind: "vulnerability"
aliases: ["CVE-2019-11043"]
title: "PHP FastCGI Process Manager (FPM): PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.99748
exploited: true
status: "open"
category: "runtime"
products: [{"name": "PHP FastCGI Process Manager (FPM)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "PHP", "fixed": ["7.1.33", "7.2.24", "7.3.11"], "affected": ">= 7.1.0, < 7.1.33; >= 7.2.0, < 7.2.24; >= 7.3.0, < 7.3.11 (FPM behind nginx)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "nginx", "php", "php-fpm", "ransomware", "runtime", "self-hosted"]
not_affected_if: ["apache", "default-config", "managed-hosting", "php-7.4-or-later", "php-cgi-not-fpm", "try-files-check"]
published_at: "2019-10-28T15:15:13+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11043", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-11043", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:20:36+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11043", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# PHP FastCGI Process Manager (FPM): PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

PHP-FPM env_path_info underflow (fpm_main.c) lets a remote attacker write past buffers and run code. It is reachable only when php-fpm sits behind nginx with a vulnerable location block. Affects PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24 and 7.3.x before 7.3.11. Gentoo also lists 5.6 as affected, with a distro backport. A public exploit exists and the flaw is exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PHP FastCGI Process Manager (FPM) affected ? fixed ?
- vendor:PHP affected >= 7.1.0, < 7.1.33; >= 7.2.0, < 7.2.24; >= 7.3.0, < 7.3.11 (FPM behind nginx) fixed 7.1.33, 7.2.24, 7.3.11

## How to check

Run php -v and php-fpm -v: vulnerable if 7.1 < 7.1.33, 7.2 < 7.2.24 or 7.3 < 7.3.11 (distro builds may be backported, so check the package changelog for CVE-2019-11043). Then run nginx -T and look for a PHP location block with 'fastcgi_split_path_info ^(.+?\.php)(/.*)$;' plus 'fastcgi_param PATH_INFO $fastcgi_path_info;' and no try_files $uri =404 or if (-f $uri) check. You are exposed if both the version and the config match.

## Fix

Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later; 7.4 and newer are not listed as affected. If you cannot patch yet, add 'try_files $fastcgi_script_name =404;' (or an equivalent file-existence check) before the fastcgi_pass in the PHP location block, so nginx drops requests for scripts that do not exist.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-11043
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-11043
- 2026-10-23T21:20:36+00:00 analyst — Read CVE record, PHP bug 78599, Red Hat, php-src NEWS and the public PoC. Affected/fixed versions and the nginx trigger are now documented. KEV lists it as exploited; PoC phuip-fpizdam is public.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-11043

## Documents

- [advisory] CVE Record CVE-2019-11043 (PHP Group) https://www.cve.org/CVERecord?id=CVE-2019-11043
- [describes] PHP Sec Bug #78599 env_path_info underflow https://bugs.php.net/bug.php?id=78599
- [fix] PHP 7.1 NEWS: 7.1.33 fix https://github.com/php/php-src/blob/PHP-7.1/NEWS
- [mitigation] Red Hat CVE-2019-11043 (mitigation) https://access.redhat.com/security/cve/cve-2019-11043
- [poc] phuip-fpizdam exploit and preconditions https://github.com/neex/phuip-fpizdam

## From the sources

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_