PHP · FastCGI Process Manager (FPM)
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
What it is
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
CISA: In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
- Added to the CISA list
- March 25, 2022
- Published
- October 28, 2019
- Severity
- High 8.7 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.7% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-120
- More details
- NVD · CVE.org · CISA
All references (20)
- https://usn.ubuntu.com/4166-1/
- https://www.debian.org/security/2019/dsa-4552
- https://www.debian.org/security/2019/dsa-4553
- https://usn.ubuntu.com/4166-2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7O…
- https://access.redhat.com/errata/RHSA-2019:3286
- https://access.redhat.com/errata/RHSA-2019:3287
- https://access.redhat.com/errata/RHSA-2019:3299
- https://access.redhat.com/errata/RHSA-2019:3300
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7L…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUH…
- http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html
- https://access.redhat.com/errata/RHSA-2019:3724
- https://access.redhat.com/errata/RHSA-2019:3735
- https://access.redhat.com/errata/RHSA-2019:3736
- https://github.com/neex/phuip-fpizdam
- https://bugs.php.net/bug.php?id=78599
- https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS
- https://security.netapp.com/advisory/ntap-20191031-0003/
- https://www.synology.com/security/advisory/Synology_SA_19_36
More exploited flaws from PHP
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 7, 2025 | Command Injection | PHPMailer | Critical 9.8 | 99.7% |
| Mar 25, 2022 | PHP-CGI Query String Parameter | PHP | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.