Secuno
ENNL
Book demo

CVE-2019-11043

PHP FastCGI Process Manager (FPM) Buffer Overflow

8.7 HIGHActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 99.8%
  1. Published28 Oct 2019
  2. Added to CISA KEV25 Mar 2022
  3. Remediation due15 Apr 2022
Actively exploited (CISA KEV)

In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.

Added to KEV: 25 Mar 2022Federal remediation due: 15 Apr 2022Used in ransomware

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityHigh
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N

Affected products

PHP≥ 7.1.0 < 7.1.33 · ≥ 7.2.0 < 7.2.24 · ≥ 7.3.0 < 7.3.11
Redhat Software Collections1.0
Tenable Tenable.sc< 5.19.0
Canonical Ubuntu Linux12.04 · 14.04 · 16.04 · 18.04
Debian Linux10.0 · 9.0
Fedoraproject Fedora29 · 30 · 31
Redhat Enterprise Linux8.0
Redhat Enterprise Linux Desktop6.0 · 7.0
Redhat Enterprise Linux Eus7.7 · 8.1 · 8.2 · 8.4
Redhat Enterprise Linux Eus Compute Node7.7
Redhat Enterprise Linux For Arm 648.0_aarch64
Redhat Enterprise Linux For Arm 64 Eus8.1_aarch64 · 8.2_aarch64 · 8.4_aarch64 · 8.6_aarch64
Redhat Enterprise Linux For Ibm Z Systems6.0_s390x · 7.0_s390x · 8.0_s390x
Redhat Enterprise Linux For Ibm Z Systems Eus7.7_s390x · 8.1_s390x · 8.2_s390x · 8.4_s390x
Redhat Enterprise Linux For Power Big Endian6.0_ppc64 · 7.0_ppc64
Redhat Enterprise Linux For Power Big Endian Eus7.7_ppc64
Redhat Enterprise Linux For Power Little Endian7.0_ppc64le · 8.0_ppc64le
Redhat Enterprise Linux For Power Little Endian Eus7.7_ppc64le · 8.1_ppc64le · 8.2_ppc64le · 8.4_ppc64le
Redhat Enterprise Linux For Scientific Computing7.0
Redhat Enterprise Linux Server6.0 · 7.0
Redhat Enterprise Linux Server Aus7.7 · 8.2 · 8.4 · 8.6
Redhat Enterprise Linux Server Tus7.7 · 8.2 · 8.4 · 8.6
Redhat Enterprise Linux Workstation6.0 · 7.0

Remediation

Fixed in
PHP≥ 7.1.33
Tenable Tenable.sc≥ 5.19.0
Patch & vendor advisories

References

and 18 more references

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-1089159.9
A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part…
CVE-2026-1089149.9
A flaw has been found in Edimax BR-6208AC 1.32. Affected by this issue is some unknown…
CVE-2026-1078158.5
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until…
CVE-2026-153409.8
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer…
CVE-2026-195708.8
The LE Audio Broadcast Sink in subsys/bluetooth/audio/bap_broadcast_sink.c copies…
CVE-2026-1079099.1
A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the…

Frequently asked

Is CVE-2019-11043 being actively exploited?

Yes. CVE-2019-11043 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 25 Mar 2022. It has been used in ransomware campaigns.

How severe is CVE-2019-11043?

CVE-2019-11043 has a CVSS 3.1 base score of 8.7, rated high. EPSS estimates a 99.8% probability of exploitation.

Which products are affected by CVE-2019-11043?

Affected products include PHP, Redhat Software Collections, Tenable Tenable.sc, Canonical Ubuntu Linux, Debian Linux, and 18 more.

How do I fix CVE-2019-11043?

Upgrade affected software to a fixed version, for example PHP 7.1.33, Tenable Tenable.sc 5.19.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-11043 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.