Vulnerability intelligence

CVE-2019-11043

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

PHP FastCGI Process Manager (FPM) CWE-120

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVSS Score

8.7

High

EPSS — Exploit Probability

100%

Riskier than 100% of all CVEs · checked 2026-10-11

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

Patch available

Federal deadline 2022-04-15