CVE-2019-11043highunder attackransomwareCWE-120

CVE-2019-11043: high-severity vulnerability in PHP

Underflow in PHP-FPM can lead to RCE

Published 28 Oct 2019 · Updated 21 Oct 2025

Follow this CVE + Monitor PHP + Monitor FastCGI Process Manager

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.7epss 100%

from disclosure to weaponsame day

Published on NVDOct 28

1st PoCSep 23

metasploitOct 22

CISA KEV+879d

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Fixed

27 products (2,529 components)

Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) · and others 22

fix ↗

Not affected

2 products (32 components) — because the vulnerable code is not present in the product

Red Hat Software Collections · Red Hat Enterprise Linux 5

Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

A memory overflow flaw in PHP-FPM allows attackers to write beyond allocated memory limits, potentially enabling them to execute arbitrary code remotely on affected servers running vulnerable PHP versions.

Technical detail

An underflow vulnerability in PHP-FPM (CWE-120) permits writes past allocated buffer boundaries into FCGI protocol space under specific FPM configurations. The attack vector is network-based through FCGI requests, affecting PHP 7.1.x < 7.3.11, 7.2.x < 7.2.24, and 7.3.x < 7.3.11, with impact of remote code execution.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

PHP · PHP

public PoCs found — 54✓ VexDay Proof

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — PHP

In the same product, most dangerous first.

CVE-2014-3622—CVE-2014-3622EPSS 3.1%

References