Buffer overflow in PHP - CVE-2019-11043

Vulnerability identifier: #VU22304

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-11043

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in env_path_info in PHP-FPM when processing untrusted input passed via URL. A remote attacker can send a specially crafted HTTP request to the affected server, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that php-fpm is used with nginx and certain nginx configuration was applied:

1. The nginx location directive forwards requests to PHP-FPM
2. The fastcgi_split_path_info directive is present and includes a regular expression beginning with a ‘^’ symbol and ending with a ‘$’ symbol
3. The fastcgi_param directive is used to assign the PATH_INFO variable
4. There are no checks in place to determine whether or not a file exists (e.g., using try_files or an if statemen

PHP
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power 9
Red Hat Enterprise Linux for IBM System z (Structure A)
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
QuTS hero
Red Hat Software Collections
Data Computing Appliance (DCA)
QNAP QTS
php (Red Hat package)
php7.0 (Debian package)
php7 (Alpine package)
php7.2 (Ubuntu package)
php7.3 (Ubuntu package)
php7.3 (Debian package)
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
php
Tenable.sc

Install updates from vendor's website.

PHP - addressed in versions 7.1.33, 7.2.24, 7.3.11
QuTS hero - update to h5.0.0.2069 Build 20220614
Data Computing Appliance (DCA) - update to 3.5.5.0
QNAP QTS - update to 5.0.1.2034 20220515
php (Red Hat package) - update to 5.4.16-46.1.el7_6
Tenable.sc - update to 5.19.0
php7.0 (Debian package) - update to 7.0.33-0+deb9u6
php7 (Alpine package) - update to 7.1.33-r0
php7.2 (Ubuntu package) - addressed in versions 7.2.24-0ubuntu0.18.04.1, 7.2.24-0ubuntu0.19.04.1
php7.3 (Ubuntu package) - update to 7.3.11-0ubuntu0.19.10.1
php7.3 (Debian package) - update to 7.3.11-1~deb10u1
php - addressed in versions 7.2.24-1.fc29, 7.3.11-1.fc30, 7.3.11-1.fc31

• Exploit #12056 - phuip-fpizdam (Exploit for CVE-2019-11043) (October 31, 2025)
• Exploit #4865 - CVE-2019-11043 (PHP-FPM Remote Command Execution Exploit) (November 21, 2020)
• Exploit #4670 - CVE-2019-11043 (This repository provides a dockerized infrastructure and a python implementation of the CVE-2019-11043 exploit.) (September 30, 2020)
• Exploit #2241 - CVE-2019-11043 ((PoC) Python version of CVE-2019-11043 exploit by neex) (March 31, 2020)
• Exploit #1455 - PHP-FPM + Nginx - Remote Code Execution (March 18, 2020)
• Exploit #1472 - PHP-FPM Underflow RCE (March 18, 2020)
• Exploit #1868 - phuip-fpizdam (Exploit for CVE-2019-11043) (March 18, 2020)

• https://bugs.php.net/bug.php?id=78599
• https://github.com/neex/phuip-fpizdam
• https://www.tenable.com/blog/cve-2019-11043-vulnerability-in-php-fpm-could-lead-to-remote-code-execution-on-nginx
• https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/php_fpm_rce.rb

• Remote code execution in PHP
• Gentoo update for PHP
• Arch Linux update for php
• Ubuntu update for PHP
• Debian update for php7.0
• Debian update for php7.3
• Red Hat update for php
• Red Hat update for php
• Red Hat update for rh-php71-php
• Red Hat update for rh-php72-php
• Amazon Linux AMI update for php71, php72, php73, php56
• OpenSUSE Linux update for php7
• Red Hat update for rh-php70-php
• Red Hat update for php:7.3
• Red Hat update for php:7.2
• OpenSUSE Linux update for php7
• Red Hat update for php:7.2
• Red Hat Enterprise Linux 7 update for php
• Buffer overflow in php7 (Alpine package)
• Multiple vulnerabilities in Tenable.sc
• QNAP QTS update for PHP
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)
• Fedora 29 update for php
• Fedora 30 update for php
• Fedora 31 update for php