High 8.7Known exploited (CISA KEV)Published Oct 28, 2019

CVE-2019-11043Underflow in PHP-FPM can lead to RCE

Updated under an hour ago (Oct 26, 2026, 8:00 PM ET)

Does this affect you?

It affects PHP and 22 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Mar 25, 2022; federal agencies had to remediate by Apr 15, 2022, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for PHP

Exploited in the last 30 days

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS: 8.7 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-120
Known exploited: Added to CISA KEV Mar 25, 2022; federal remediation due Apr 15, 2022; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.75% (percentile 100)
Assigned by: php
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

PHP PHP php:php (from the name)	from 7.1.x before 7.1.33; from 7.2.x before 7.2.24; from 7.3.x before 7.3.11	CNA record
php php php:php	from 7.1.0 before 7.1.33; from 7.2.0 before 7.2.24; from 7.3.0 before 7.3.11	NVD
canonical ubuntu_linux canonical:ubuntu_linux	12.04; 14.04; 16.04; 18.04; 19.04; 19.10	NVD
debian debian_linux debian:debian_linux	9.0; 10.0	NVD
fedoraproject fedora fedoraproject:fedora	29; 30; 31	NVD
tenable tenable.sc tenable:tenable.sc	before 5.19.0	NVD
redhat software_collections redhat:software_collections	1.0	NVD
redhat enterprise_linux redhat:enterprise_linux	8.0	NVD
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop	6.0; 7.0	NVD
redhat enterprise_linux_eus redhat:enterprise_linux_eus	7.7; 8.1; 8.2; 8.4; 8.6; 8.8	NVD
1–10 of 24

References

References

https://github.com/neex/phuip-fpizdam	x-refsource-misc, exploit, third-party-advisory
https://bugs.php.net/bug.php?id=78599	x-refsource-confirm, exploit, issue-tracking, patch, vendor-advisory
https://usn.ubuntu.com/4166-1/	vendor-advisory, x-refsource-ubuntu, third-party-advisory
https://www.debian.org/security/2019/dsa-4552	vendor-advisory, x-refsource-debian, mailing-list, third-party-advisory
https://www.debian.org/security/2019/dsa-4553	vendor-advisory, x-refsource-debian, mailing-list, third-party-advisory
https://usn.ubuntu.com/4166-2/	vendor-advisory, x-refsource-ubuntu, third-party-advisory
https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS	x-refsource-confirm, third-party-advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/	vendor-advisory, x-refsource-fedora, mailing-list, third-party-advisory
https://security.netapp.com/advisory/ntap-20191031-0003/	x-refsource-confirm, third-party-advisory
https://access.redhat.com/errata/RHSA-2019:3286	vendor-advisory, x-refsource-redhat, third-party-advisory
1–10 of 26

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.