CVE-2019-11043— Underflow in PHP-FPM can lead to RCE
Quick assessment
Affected
PHP PHP
Exploitation
Confirmed exploitation in the wild; remediate immediately
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHPGroup和开放源代码社区的共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。以下产品及版本受到影响：PHP 7.1.33之前版本的7.1.x版本，7.2.24之前版本的7.2.x版本，7
In-the-Wild Activity Observed
cisa_kev · confirmed
Possible ATT&CK Techniques 3 AI
T1132 · Data Encoding T1200 · Hardware Additions T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-11043
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Underflow in PHP-FPM can lead to RCE
Source: CVE Program / CVE List V5
Vulnerability Description
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未进行输入大小检查的缓冲区拷贝(传统缓冲区溢出)
Source: CVE Program / CVE List V5
Vulnerability Title
PHP 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
PHP（PHP：Hypertext Preprocessor，PHP：超文本预处理器）是PHPGroup和开放源代码社区的共同维护的一种开源的通用计算机脚本语言。该语言主要用于Web开发，支持多种数据库及操作系统。 PHP中存在缓冲区错误漏洞。该漏洞源于网络系统或产品在内存上执行操作时，未正确验证数据边界，导致向关联的其他内存位置上执行了错误的读写操作。攻击者可利用该漏洞导致缓冲区溢出或堆溢出等。以下产品及版本受到影响：PHP 7.1.33之前版本的7.1.x版本，7.2.24之前版本的7.2.x版本，7
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
II. Public POCs for CVE-2019-11043
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | Exploit for CVE-2019-11043 | https://github.com/neex/phuip-fpizdam | POC Details |
| 2 | CVE-2019-11043 | https://github.com/B1gd0g/CVE-2019-11043 | POC Details |
| 3 | None | https://github.com/tinker-li/CVE-2019-11043 | POC Details |
| 4 | php-fpm+Nginx RCE | https://github.com/jas502n/CVE-2019-11043 | POC Details |
| 5 | PHP-FPM Remote Code Execution Vulnerability (CVE-2019-11043) POC in Python | https://github.com/AleWong/PHP-FPM-Remote-Code-Execution-Vulnerability-CVE-2019-11043- | POC Details |
| 6 | None | https://github.com/ianxtianxt/CVE-2019-11043 | POC Details |
| 7 | None | https://github.com/fairyming/CVE-2019-11043 | POC Details |
| 8 | None | https://github.com/akamajoris/CVE-2019-11043-Docker | POC Details |
| 9 | (PoC) Python version of CVE-2019-11043 exploit by neex | https://github.com/theMiddleBlue/CVE-2019-11043 | POC Details |
| 10 | CVE-2019-11043 PHP远程代码执行 | https://github.com/shadow-horse/cve-2019-11043 | POC Details |
| 11 | Python exp for CVE-2019-11043 | https://github.com/huowen/CVE-2019-11043 | POC Details |
| 12 | Docker image and commands to check CVE-2019-11043 vulnerability on nginx/php-fpm applications. | https://github.com/ypereirareis/docker-CVE-2019-11043 | POC Details |
| 13 | CVE-2019-11043 && PHP7.x && RCE EXP | https://github.com/MRdoulestar/CVE-2019-11043 | POC Details |
| 14 | CVE-2019-11043 PHP7.x RCE | https://github.com/0th3rs-Security-Team/CVE-2019-11043 | POC Details |
| 15 | Ladon POC Moudle CVE-2019-11043 (PHP-FPM + Ngnix) | https://github.com/k8gege/CVE-2019-11043 | POC Details |
| 16 | remote debug environment for CLion | https://github.com/moniik/CVE-2019-11043_env | POC Details |
| 17 | This repository provides a dockerized infrastructure and a python implementation of the CVE-2019-11043 exploit. | https://github.com/kriskhub/CVE-2019-11043 | POC Details |
| 18 | None | https://github.com/alokaranasinghe/cve-2019-11043 | POC Details |
| 19 | quick and dirty PHP RCE proof of concept | https://github.com/corifeo/CVE-2019-11043 | POC Details |
| 20 | PHP-FPM Remote Command Execution Exploit | https://github.com/lindemer/CVE-2019-11043 | POC Details |
| 21 | CVE-2019-11043 | https://github.com/jptr218/php_hack | POC Details |
| 22 | CVE-2019-11043 LAB | https://github.com/jas9reet/CVE-2019-11043 | POC Details |
| 23 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E8%AF%AD%E8%A8%80%E6%BC%8F%E6%B4%9E/PHP-FPM%20%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2019-11043.md | POC Details |
| 24 | https://github.com/vulhub/vulhub/blob/master/php/CVE-2019-11043/README.md | POC Details | |
| 25 | exploit for CVE-2019-11043 | https://github.com/bayazid-bit/CVE-2019-11043- | POC Details |
| 26 | None | https://github.com/a1ex-var1amov/ctf-cve-2019-11043 | POC Details |
| 27 | Exploit for CVE-2019-11043 | https://github.com/CodeHex083/phuip-fpizdam | POC Details |
| 28 | None | https://github.com/AndrewMas99/CVE-2019-11043-Vulnerability | POC Details |
| 29 | Python port of an ExploitDB proof-of-concept. | https://github.com/gon905332-jpg/cve-2019-11043.py | POC Details |
| 30 | In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11043.yaml | POC Details |
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-11043
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-11043 (15)
-
https://support.apple.com/kb/HT210919 x_refsource_CONFIRM
-
https://security.netapp.com/advisory/ntap-20191031-0003/ x_refsource_CONFIRM
-
-
-
-
🔗 USN-4166-1: PHP vulnerability | Ubuntu security notices | Ubuntu Read full article vendor-advisory x_refsource_UBUNTU
-
-
-
-
-
-
-
-
Exploits & Public PoCs for CVE-2019-11043 (1)
Mailing List Discussions for CVE-2019-11043 (7)
-
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html vendor-advisory x_refsource_SUSE
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/ vendor-advisory x_refsource_FEDORA
-
-
Other References for CVE-2019-11043 (4)
-
https://github.com/neex/phuip-fpizdam x_refsource_MISC
-
https://www.tenable.com/security/tns-2021-14 x_refsource_CONFIRM
-
https://bugs.php.net/bug.php?id=78599 x_refsource_CONFIRM
-
https://www.synology.com/security/advisory/Synology_SA_19_36 x_refsource_CONFIRM
IV. Related Vulnerabilities
Same product: PHP
-
CVE-2026-92842
OOB read / info leak in convert.* stream filters when line-b -
CVE-2026-91768
IPv6 ACL bypass in FastCGI listen.allowed_clients due to par -
CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatc -
CVE-2026-91767
Heap-buffer-overflow in php_openssl_matches_wildcard_name on -
CVE-2025-1218
Various packet overreads in mysqlnd_writeprotocol.c
Same vendor: PHP
-
CVE-2026-14355
ext/openssl: Memory corruption in openssl_encrypt with AES-W -
CVE-2026-45062
FrankenPHP: Unsafe Unicode Handling in CGI Path Splitting Al -
CVE-2026-24895
FrankenPHP affected by Path Confusion via Unicode casing in -
CVE-2026-24894
FrankenPHP leaks session data between requests in worker mod -
CVE-2014-3622
PHP Posthandler 资源管理错误漏洞
Same weakness: CWE-120
-
CVE-2026-103227
GPAC DASH Client dash_client.c gf_dash_resolve_url buffer ov -
CVE-2026-81433
Fireware OS Pre-Authentication Stack Buffer Overflow in fing -
CVE-2026-102296
ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Res -
CVE-2026-6730
Multiple Vulnerabilities in IBM Concert Software -
CVE-2026-94101
Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow
V. Comments for CVE-2019-11043
No comments yet