Is CVE-2019-11043 being actively exploited?

Yes. CVE-2019-11043 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added on March 25, 2022.

What is the CVSS score for CVE-2019-11043?

CVE-2019-11043 has a CVSS 3.1 base score of 8.7 (HIGH).

CVE-2019-11043

HIGH · CVSS 8.7CISA KEV: actively exploitedEPSS 99.7%EU EUVD: exploited

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

Key facts

CVSS score: 8.7 (v3.1)
Severity: HIGH
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness (CWE): CWE-120
EPSS score: 99.7% (100th percentile)
In CISA KEV: Yes, added March 25, 2022
In EU EUVD: Yes (EUVD-2019-2751)
Published: October 28, 2019
NVD last modified: June 17, 2026
Status: Analyzed

CISA Known Exploited Vulnerability

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

Added to the KEV catalog on March 25, 2022; federal remediation due April 15, 2022. Known to be used in ransomware campaigns.

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2019-2751 in the EU Vulnerability Database. ENISA flags it as known exploited. Last updated in EUVD on October 21, 2025.

View on the EU Vulnerability Database

Affected products

canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
canonical / ubuntu linux
debian / debian linux
debian / debian linux
fedoraproject / fedora
fedoraproject / fedora
fedoraproject / fedora
php / php
redhat / enterprise linux
redhat / enterprise linux desktop
redhat / enterprise linux desktop
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus compute node
redhat / enterprise linux for arm 64
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for arm 64 eus
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for power big endian
redhat / enterprise linux for power big endian
redhat / enterprise linux for power big endian eus
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for scientific computing
redhat / enterprise linux server

and 14 more…

Certified products that may be affected

26 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
Red Hat Enterprise Linux 8.6 - Red Hat, Inc. - Common Criteria CCEVS-VR-VID-11309-2024 - archived
Red Hat Enterprise Linux 8 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 4642 - historical

See all 26 in the Security Certifications Explorer.

References

http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00011.html(Mailing List, Third Party Advisory)
http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00014.html(Mailing List, Third Party Advisory)
http://packetstormsecurity.com/files/156642/PHP-FPM-7.x-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
http://seclists.org/fulldisclosure/2020/Jan/40(Mailing List, Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3286(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3287(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3299(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3300(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3724(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3735(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2019:3736(Third Party Advisory)
https://access.redhat.com/errata/RHSA-2020:0322(Third Party Advisory)
https://bugs.php.net/bug.php?id=78599(Exploit, Issue Tracking, Patch, Vendor Advisory)
https://github.com/neex/phuip-fpizdam(Exploit, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W23TP6X4H7LB645FYZLUPNIRD5W3EPU/(Mailing List, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FSNBUSPKMLUHHOADROKNG5GDWDCRHT5M/(Mailing List, Third Party Advisory)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T62LF4ZWVV7OMMIZFO6IFO5QLZKK7YRD/(Mailing List, Third Party Advisory)
https://seclists.org/bugtraq/2020/Jan/44(Mailing List, Third Party Advisory)
https://security.netapp.com/advisory/ntap-20191031-0003/(Third Party Advisory)
https://support.apple.com/kb/HT210919(Third Party Advisory)
https://support.f5.com/csp/article/K75408500?utm_source=f5support&amp%3Butm_medium=RSS(Third Party Advisory)
https://usn.ubuntu.com/4166-1/(Third Party Advisory)
https://usn.ubuntu.com/4166-2/(Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-11043(US Government Resource)
https://www.debian.org/security/2019/dsa-4552(Mailing List, Third Party Advisory)
https://www.debian.org/security/2019/dsa-4553(Mailing List, Third Party Advisory)
https://www.synology.com/security/advisory/Synology_SA_19_36(Third Party Advisory)
https://www.tenable.com/security/tns-2021-14(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain