Skip to content
fr Sign in
8.7 High Exploited · ransomware

CVE-2019-11043 PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions.
Ransomware campaigns Known to be used
Weakness CWE-120

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Affected products and versions

Product Affected versions Fixed in
PHP 7.3 7.3.x → < 7.3.11 7.3.11
PHP 7.2 7.2.x → < 7.2.24 7.2.24
PHP 7.1 7.1.x → < 7.1.33 7.1.33

References

Timeline

  1. Published
  2. Added to the KEV catalogue
  3. Last modified

Other CVEs of PHP

The 10 CVEs of PHP →
CVE-2026-14355 In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD… 5.6 Medium CVE-2024-9026 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it… 3.3 Low CVE-2024-8927 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used… 7.5 High CVE-2024-8926 In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard… 8.1 High
Track this CVE