Skip to main content
CRITICAL CISA KEV

CVE-2019-11043

CVSS v3

9.8

CRITICAL

EPSS Score

99.7 %

exploit probability, as of 2026-10-19

CISA KEV

Yes

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for php.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

  • apcu-panelAlmaLinux:8all versions · fixed in 5.1.17-1.module_el8.3.0+2009+b272fdef
  • libzipAlmaLinux:8all versions · fixed in 1.5.2-1.module_el8.4.0+2229+b272fdef
  • libzip-develAlmaLinux:8all versions · fixed in 1.5.2-1.module_el8.5.0+152+112d3b8c
  • libzip-toolsAlmaLinux:8all versions · fixed in 1.5.2-1.module_el8.3.0+2009+b272fdef
  • php-pearAlmaLinux:8all versions · fixed in 1:1.10.9-1.module_el8.3.0+2009+b272fdef
  • php-pecl-apcuAlmaLinux:8all versions · fixed in 5.1.17-1.module_el8.4.0+2229+b272fdef
  • php-pecl-apcu-develAlmaLinux:8all versions · fixed in 5.1.17-1.module_el8.5.0+152+112d3b8c
  • php-pecl-zipAlmaLinux:8all versions · fixed in 1.15.4-1.module_el8.3.0+2009+b272fdef

Vendor advisories

  • CVE-2019-11043 Red Hat Product Security2,407 products fixed

    php: underflow in env_path_info in fpm_main.c

  • ICSA-26-239-02 CISA4 known affected

    All-Line Equipment Company Fuel-Boss

    All-Line Equipment Company Fuel-Boss V1 Standard: >=|<=PHP_7.1.5_7.1.5 · All-Line Equipment Company Fuel-Boss V1 Portal: >=|<=PHP_7.1.5_7.1.5 · All-Line Equipment Company Fuel-Boss V1 Master/Slave: >=|<=PHP_7.1.5_7.1.5

  • ICSA-26-027-02 CISA1 known affected

    Festo Didactic SE MES PC

    Festo Didactic SE MES PC shipped with Windows 10

  • RHSA-2020:2835 Red Hat Product Security191 products fixed

    Red Hat Security Advisory: php security update

  • RHSA-2020:0322 Red Hat Product Security141 products fixed

    Red Hat Security Advisory: php:7.2 security update

  • RHSA-2019:3736 Red Hat Product Security275 products fixed

    Red Hat Security Advisory: php:7.3 security update

6 more advisories

Full record on NVD

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CISA Known Exploited Vulnerability

Date Added
2022-03-25
Patch Due Date
2022-04-15
Ransomware Use
Known

Technical details

Published
2019-10-28
Exploit-DB
EDB-47553 EDB-48182

Frequently asked questions

What is CVE-2019-11043?

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Is CVE-2019-11043 actively exploited?

Yes. CVE-2019-11043 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 2022-04-15.

What is the CVSS score for CVE-2019-11043?

CVE-2019-11043 has a CVSS v3 base score of 9.8 (CRITICAL severity).

Running php? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, March 2022Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database