CoreCVE
Back

CRITICAL KEV Used in ransomware campaigns

Underflow in PHP-FPM can lead to RCE

Published Oct 28, 2019 ·Due Apr 15, 2022

Description

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Affected products

Remediation

Vendor solution

Configuring nginx (or other server that implements the front-end part of the FPM protocol) to check for the existence of the target file before passing it to PHP FPM (e.g. "try_files $uri =404" or "if (-f $uri)" in nginx) for would prevent this vulnerability from happening.

Red Hat statement

This issue only affects instances running php-fpm under nginx server software as environment paths and parameters are handled by different code pieces depending on the server php-fpm is running under. The code where this issue is found is used exclusively when php-fpm detects the request came through an nginx server. Red Hat Product Security team rated this issue as having a Critical security impact as an attacker may take advantage from the existing bug to cause Remote Code Execution on network exposed software.

Red Hat mitigation

1) Check your nginx configuration files, specially the ones related to php-fpm for presence of pattern bellow on fastcgi_split_path_info regex and PATH_INFO parameter: ~~~ fastcgi_split_path_info ^(.+?\.php)(/.*)$; fastcgi_param PATH_INFO $fastcgi_path_info; ~~~ 2) If fastcgi_split_path_info regex matches with the one above, for each fastcgi_param PATH_INFO entry perform the following change: ~~~ fastcgi_param PATH_INFO $fastcgi_path_info if_not_empty; ~~~ This step will allow you to safely continue using PATH_INFO parameter while the patch is not applied. 3) Restart your nginx instance: ~~~ systemctl restart nginx ~~~

Metrics

Weaknesses (2)

CWE-120

Classic Buffer Overflow

CWE-787

Out-of-bounds Write

References (34)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner php
Published Oct 28, 2019
Updated Oct 21, 2025
Reserved Apr 9, 2019
Link CVE-2019-11043
CISA Vulnrichment
Updated Feb 7, 2025
NVD
Status Analyzed
Modified Jun 17, 2026
Link CVE-2019-11043
Red Hat
Severity Critical
Public date Oct 24, 2019
Links CVE-2019-11043 - Bugzilla