What’s Vulnerable › Vulnerabilities
CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2022-03-25
- EPSS: 99.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-10-28 · updated 2026-06-17
- Weakness: CWE-120
Description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 19.04, 19.10
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 29, 30, 31
- PHP: from 7.1.0 before 7.1.33; from 7.2.0 before 7.2.24; from 7.3.0 before 7.3.11 — fixed in 7.1.33, 7.2.24, 7.3.11
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Desktop: 6.0, 7.0
- RedHat Enterprise Linux Eus: 7.7, 8.1, 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux Eus Compute Node: 7.7
- RedHat Enterprise Linux For Arm 64: 8.0_aarch64
- RedHat Enterprise Linux For Arm 64 Eus: 8.1_aarch64, 8.2_aarch64, 8.4_aarch64, 8.6_aarch64, 8.8_aarch64
- RedHat Enterprise Linux For Ibm Z Systems: 6.0_s390x, 7.0_s390x, 8.0_s390x
- RedHat Enterprise Linux For Ibm Z Systems Eus: 7.7_s390x, 8.1_s390x, 8.2_s390x, 8.4_s390x, 8.6_s390x, 8.8_s390x
- RedHat Enterprise Linux For Power Big Endian: 6.0_ppc64, 7.0_ppc64
- RedHat Enterprise Linux For Power Big Endian Eus: 7.7_ppc64
- RedHat Enterprise Linux For Power Little Endian: 7.0_ppc64le, 8.0_ppc64le
- RedHat Enterprise Linux For Power Little Endian Eus: 7.7_ppc64le, 8.1_ppc64le, 8.2_ppc64le, 8.4_ppc64le, 8.6_ppc64le, 8.8_ppc64le
- RedHat Enterprise Linux For Scientific Computing: 7.0
- RedHat Enterprise Linux Server: 6.0, 7.0
- RedHat Enterprise Linux Server Aus: 7.7, 8.2, 8.4, 8.6
- RedHat Enterprise Linux Server Tus: 7.7, 8.2, 8.4, 8.6, 8.8
- RedHat Enterprise Linux Workstation: 6.0, 7.0
- RedHat Software Collections: 1.0
- Tenable.sc: before 5.19.0 — fixed in 5.19.0
How to fix
Upgrade to a fixed version: PHP 7.1.33, 7.2.24, 7.3.11; Tenable.sc 5.19.0. Check the vendor advisory for mitigations.
In the news
- CVE-2026-109618: PHP-CGI Pointer Underflow → Remote Code Execution (CVSS 9.2)
- php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities
References
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html
- http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/Jan/40
- https://access.redhat.com/errata/RHSA-2019:3286
- https://access.redhat.com/errata/RHSA-2019:3287
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/errata/RHSA-2019:3300
- https://access.redhat.com/errata/RHSA-2019:3724
- https://access.redhat.com/errata/RHSA-2019:3735
- https://access.redhat.com/errata/RHSA-2019:3736
- https://access.redhat.com/errata/RHSA-2020:0322
Get alerted when CVE-2019-11043 or the next vulnerability affects your stack