VULNERABILITY INTELLIGENCE
CVE-2019-11043
CVSS score8.7 HIGH
EPSS probability99.78%
CISA KEVKnown exploited vulnerability
Published2019-10-28
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Known Exploited Vulnerability
PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability
Vendor / product: PHP / FastCGI Process Manager (FPM)
Description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Weakness classification
- security@php.net: CWE-120
- nvd@nist.gov: CWE-787
Primary references
- security@php.net — Mailing List, Third Party Advisory
- security@php.net — Mailing List, Third Party Advisory
- security@php.net — Exploit, Third Party Advisory, VDB Entry
- security@php.net — Mailing List, Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory
- security@php.net — Third Party Advisory