CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
- State
- Published
- Severity
- 8.7 High
- Published
- Oct 28, 2019
- Updated
- Oct 21, 2025
- Reserved
- Apr 9, 2019
Description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.7 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | php |
Weaknesses
- CWE-120 Buffer Overflow
Affected Products
| Product | Versions |
|---|---|
PHPPHP |
|
References
- https://github.com/neex/phuip-fpizdam
- https://bugs.php.net/bug.php?id=78599
- USN-4166-1vendor-advisory
- DSA-4552vendor-advisory
- DSA-4553vendor-advisory
- USN-4166-2vendor-advisory
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- FEDORA-2019-4adc49a476vendor-advisory
- https://security.netapp.com/advisory/ntap-20191031-0003/
- RHSA-2019:3286vendor-advisory
- RHSA-2019:3287vendor-advisory
- RHSA-2019:3299vendor-advisory
- RHSA-2019:3300vendor-advisory
- FEDORA-2019-187ae3128dvendor-advisory
- FEDORA-2019-7bb07c3b02vendor-advisory
- openSUSE-SU-2019:2441vendor-advisory
- RHSA-2019:3724vendor-advisory
- RHSA-2019:3735vendor-advisory
- RHSA-2019:3736vendor-advisory
- https://www.synology.com/security/advisory/Synology_SA_19_36
- openSUSE-SU-2019:2457vendor-advisory
- https://support.apple.com/kb/HT210919
- 20200129 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierramailing-list
- 20200131 APPLE-SA-2020-1-28-2 macOS Catalina 10.15.3, Security Update 2020-001 Mojave, Security Update 2020-001 High Sierramailing-list
- RHSA-2020:0322vendor-advisory
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- https://www.tenable.com/security/tns-2021-14
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.