PHP-FPM environment path underflow

Summary

Remote code execution in certain PHP-FPM configurations. A buffer underflow in fpm_main.c can write past an allocated buffer into FCGI protocol data.

Component: PHP-FPM. Disclosed: 24 October 2019. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. NIST NVD

Fixed versions

Fixed in 7.1.33, 7.2.24 and 7.3.11. All three branches are end-of-life today; using them is itself a risk. NIST NVD

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• PHP-FPM deployment in a configuration where the FastCGI path handling is exposed.
• NVD says 'certain configurations'; it does not describe every FPM deployment as affected.
• Not the same flaw as PHP2Shell, despite both being request-lifecycle memory bugs.

Exploitation status

CISA added CVE-2019-11043 to KEV on 25 March 2022. KEV indicates known exploitation; it does not quantify incidents.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

Mechanism

The original PHP bug report describes an env_path_info underflow in fpm_main.c that can lead to remote code execution. NVD's description says that in certain FPM configurations the module can write past allocated buffers into the space reserved for FCGI protocol data.

That wording matters. 'PHP-FPM' is not by itself a complete exposure statement. The deployment configuration and the request path handling are part of the condition.

Why it remains a useful reference

The flaw is old, but its operational lessons are current: check the actual SAPI, check the vendor package changelog, and do not assume an upstream version string reflects a distribution backport. The same issues appear in the PHP2Shell verification guide.

It is a historical reference, not evidence that PHP2Shell shares a root cause. The relation on this site is deliberately labelled as similar mechanism only.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.