PHP-FPM Remote Code Execution Vulnerability (CVE-2019-11043) Security Advisory and Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTPHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11 running in certain Nginx + PHP-FPM configurations
Unauthenticated remote attackers can trigger an out-of-bounds memory write in the PHP-FPM process, leading to arbitrary remote code execution (RCE) on the target web server
Immediately upgrade PHP to patched versions (7.1.33, 7.2.24, 7.3.11 or higher) and configure Nginx with 'try_files' to verify file existence before passing requests to FastCGI
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The most effective remediation is upgrading PHP to a secure, patched version.
# For Ubuntu/Debian systems
sudo apt-get update
sudo apt-get --only-upgrade install php7.3-fpm php7.3-cli php7.3-common -y
# For CentOS/RHEL systems (using Remi repository)
sudo yum clean all
sudo yum update php-fpm php-cli php-common -y
# Restart PHP-FPM to apply the patch
sudo systemctl restart php-fpm
php-fpm -v2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, modify your Nginx configuration file (e.g., /etc/nginx/nginx.conf) to ensure that only existing files are processed by PHP-FPM.
# Nginx Virtual Host Configuration
server {
listen 80;
server_name localhost;
root /var/www/html;
location ~ [^/]\.php(/|$) {
# Mitigate the vulnerability by verifying file existence
try_files $uri =404;
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
}
}Validate and reload the Nginx configuration:
sudo nginx -t
sudo systemctl restart nginx3. Log Audit & IoC Verification Commands
Use the following commands to scan Nginx access logs for potential exploitation attempts containing newline characters and PHP configuration injections.
# Scan Nginx access logs for exploit patterns (newline characters and PHP_VALUE injection)
grep -Ei 'php_value|%0a' /var/log/nginx/access.log
# Verify the currently running PHP-FPM version
php -v | grep -E '7\.[1-3]\.'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-11043) is an out-of-bounds write (CWE-120, CWE-787) located in the environment variable processing logic of PHP-FPM's fpm_main.c. When Nginx is configured with the fastcgi_split_path_info directive to split URLs into script paths and path info (PATH_INFO), it fails to properly handle newline characters (%0a). A specially crafted request containing a newline character causes the pointer arithmetic to miscalculate the length of path_info as a negative value or point to an unintended memory address. This leads to writing past allocated buffers into the space reserved for FastCGI protocol data.
2. Exploitation Mechanics & Attack Scenario
An attacker exploits the lack of path validation in Nginx before forwarding requests to PHP-FPM:
- The attacker sends a crafted HTTP request containing a newline character and FastCGI configuration parameters, such as
http://target.com/index.php/PHP_VALUE%0aname=value. - Nginx splits the path according to the configured regex and forwards the corrupted parameters to PHP-FPM.
- Inside PHP-FPM, the
init_request_info()function processes the malformed path, causing a buffer overrun in theFCGI_ENVstructure. - By overwriting specific memory structures, the attacker can dynamically manipulate PHP configuration directives (e.g.,
LD_PRELOADorauto_prepend_file) to execute arbitrary PHP code and system commands under the privileges of the web server process.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability represents an extreme risk to enterprise infrastructure. Successful exploitation allows complete compromise of the Web Application Server (WAS). Attackers can leverage this access to exfiltrate database credentials, steal sensitive data, deploy ransomware, or pivot deeper into the internal network, causing severe operational and financial damage.
Official Vendor Advisories & References
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.
Frequently Asked SecOps Questions (CVE-2019-11043)
FAQQ1. How critical is CVE-2019-11043 and is it actively exploited in the wild?
CVE-2019-11043 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-11043?
Primary impacted vendors include php, nginx across php-fpm, php. Scope summary: Servers running Nginx + PHP-FPM with the following PHP versions: - PHP 7.1.x prior to 7.1.33 - PHP 7.2.x prior to 7.2.24 - PHP 7.3.x prior to 7.3.11 ※ Only vulnerable if 'fastcgi_split_path_info' is defined in Nginx configuration without proper file existence checks (e.g., 'try_files $uri =404').
Q3. What temporary mitigations or workarounds exist for CVE-2019-11043 before patching?
[Mitigation] Immediately upgrade PHP to patched versions (7.1.33, 7.2.24, 7.3.11 or higher) and configure Nginx with 'try_files' to verify file existence before passing requests to FastCGI Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-11043
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (php)
View Category →PHP Remote Code Execution (RCE) via OOM Memory Corruption (CVE-2026-109618)
[Affected Scope] All web applications and server environments running on the PHP engine.
PHP Remote Code Execution (RCE) via Global State Use-After-Free (CVE-2026-109619)
[Affected Scope] PHP 8.1, 8.2, and 8.3 environments without the latest security patches.
Google Chrome Skia Graphics Engine Out-of-bounds Write Vulnerability (CVE-2026-3909) Technical Advisory
[Affected Scope] Google Chrome and Chromium-based browsers prior to version 146.0.7680.75
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.