HackerFeeds
All CVEs

CVE-2019-11043

HIGH8.7
CISA KEV

Published 2019-10-28 · Updated 2026-06-17 · Source security@php.net

Summary

CVE-2019-11043 is a high-severity (CVSS 8.7) vulnerability in PHP FastCGI Process Manager (FPM). CISA added it to the Known Exploited Vulnerabilities catalog on March 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by April 15, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. PHP has 3 vulnerabilities in the KEV catalog, 1 of them linked to ransomware.

All 3 known-exploited PHP vulnerabilities →

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

CWE-120CWE-787

CISA Known-Exploited Vulnerability

Product: PHP — FastCGI Process Manager (FPM)

Name: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Date added: 2022-03-25 · Due: 2022-04-15

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD