{"id":"CVE-2019-11043","published":"2019-10-28T15:15:13Z","modified":"2026-06-17T02:12:11Z","title":"PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability","vendor":"PHP","product":"FastCGI Process Manager (FPM)","tier":"core","eol":null,"description":{"text":"In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"The PHP FastCGI Process Manager (FPM) contains a buffer overflow in certain configurations of its setup, where the module can write past allocated buffers into the space reserved for FCGI protocol data. An attacker with remote network access, requiring no privileges or user interaction, could exploit this flaw under those specific FPM configurations to achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:36Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99783,"percentile":0.99955,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-11043","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-12-24","exploitedFirstSeen":"2019-12-24","ransomware":true,"evidence":[{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-november-2019","date":"2019-12-24"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities--exploits--and-malware-driving-attack-campaigns-in-december-2019","date":"2020-01-31"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://thedfirreport.com/2023/12/18/lets-opendir-some-presents-an-analysis-of-a-persistent-actors-activity/","date":"2023-12-18"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-13&host_type=src&vulnerability=cve-2019-11043","date":"2024-01-13"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2024-0208.pdf","date":"2024-02-08"},{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Public_Sector_Threat_Landscape.pdf","date":"2024-05-14"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2024_Trustwave_Professional_Services_Sector_Threat_Landscape.pdf","date":"2024-06-26"},{"url":"https://www.trustwave.com/hubfs/Web/Library/Documents_pdf/2025_Trustwave_Manufacturing_Methods_of_Targeting_and_Breaching.pdf","date":"2025-03-04"}],"evidenceTotal":13,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Critical PHP Remote Code Execution Flaws Draw Early Attacks Across Millions of Exposed Web Hosts","url":"https://otx.alienvault.com/pulse/6ad9246cb03e78ec5b4c0392","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-120","name":"Buffer Copy without Checking Size of Input"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Jan/40","tags":["Mailing List","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3286","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3287","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3299","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3300","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3724","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3735","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3736","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0322","tags":["Third Party Advisory"]},{"url":"https://bugs.php.net/bug.php?id=78599","tags":["Exploit","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://github.com/neex/phuip-fpizdam","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2020/Jan/44","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20191031-0003/","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT210919","tags":["Third Party Advisory"]},{"url":"https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4166-1/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4166-2/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4552","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4553","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_36","tags":["Third Party Advisory"]},{"url":"https://www.tenable.com/security/tns-2021-14","tags":["Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://seclists.org/fulldisclosure/2020/Jan/40","tags":["Mailing List","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3286","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3287","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3299","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3300","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3724","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3735","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3736","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0322","tags":["Third Party Advisory"]},{"url":"https://bugs.php.net/bug.php?id=78599","tags":["Exploit","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://github.com/neex/phuip-fpizdam","tags":["Exploit","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/","tags":["Mailing List","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2020/Jan/44","tags":["Mailing List","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20191031-0003/","tags":["Third Party Advisory"]},{"url":"https://support.apple.com/kb/HT210919","tags":["Third Party Advisory"]},{"url":"https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4166-1/","tags":["Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4166-2/","tags":["Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4552","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4553","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_36","tags":["Third Party Advisory"]},{"url":"https://www.tenable.com/security/tns-2021-14","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated network exploitation of FPM service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"it is possible to cause FPM module to write past allocated buffers","start":117,"end":183}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Writes enable remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"thus opening the possibility of remote code execution","start":232,"end":285}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-2751","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2751","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":47553,"url":"https://www.exploit-db.com/exploits/47553","title":"PHP-FPM + Nginx - Remote Code Execution","type":"webapps","platform":"php","date":"2019-10-28","verified":false,"provenance":"source"},{"id":48182,"url":"https://www.exploit-db.com/exploits/48182","title":"PHP-FPM - Underflow Remote Code Execution (Metasploit)","type":"remote","platform":"php","date":"2020-03-09","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2019-10-28"},"pocGithub":{"count":23,"skipped":4,"earliest":"2019-09-23","earliestUrl":"https://github.com/neex/phuip-fpizdam","repos":[{"name":"neex/phuip-fpizdam","url":"https://github.com/neex/phuip-fpizdam","stars":1837,"created":"2019-09-23"},{"name":"theMiddleBlue/CVE-2019-11043","url":"https://github.com/theMiddleBlue/CVE-2019-11043","stars":148,"created":"2019-10-28"},{"name":"jas502n/CVE-2019-11043","url":"https://github.com/jas502n/CVE-2019-11043","stars":105,"created":"2019-10-23"},{"name":"akamajoris/CVE-2019-11043-Docker","url":"https://github.com/akamajoris/CVE-2019-11043-Docker","stars":27,"created":"2019-10-24"},{"name":"k8gege/CVE-2019-11043","url":"https://github.com/k8gege/CVE-2019-11043","stars":16,"created":"2019-11-11"}]},"metasploit":[{"name":"PHP-FPM Underflow RCE","module":"exploit/multi/http/php_fpm_rce","type":"exploit","disclosureDate":"2019-10-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/php_fpm_rce.rb"}],"nuclei":[{"id":"CVE-2019-11043","name":"PHP-FPM Path Info Buffer Underflow - Remote Code Execution","severity":"critical","path":"http/cves/2019/CVE-2019-11043.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-11043.yaml"}],"first":{"date":"2019-09-23","source":"PoC-in-GitHub","url":"https://github.com/neex/phuip-fpizdam"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html","https://bugs.php.net/bug.php?id=78599","https://github.com/neex/phuip-fpizdam"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-09-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2019-10-22, Exploit-DB 2019-10-28","url":"https://github.com/neex/phuip-fpizdam","provenance":"source"},{"date":"2019-10-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11043","provenance":"source"},{"date":"2019-12-24","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-november-2019","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-2751","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":879},"priority":{"score":79.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2501 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 2 Exploit-DB entries; 23 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}