CVE-2019-11043
CISA KEVPublished March 25, 2022 · Updated April 3, 2026
high
Official Description+
In some versions of PHP in certain configurations of FPM setup, it is possible to cause FPM module to write past allocated buffers allowing the possibility of remote code execution.
Affected Products
| Vendor | Product |
|---|---|
| PHP | FastCGI Process Manager (FPM) |
Patch Status
Patch by 2022-04-15
Recommended Actions
- Check if your systems use any of the affected products listed above.
- Apply vendor patches immediately if available.
- This vulnerability is in CISA's Known Exploited Vulnerabilities catalog — prioritize remediation.
- Monitor vendor advisories for updates and additional mitigations.
- Review logs for indicators of compromise related to CVE-2019-11043.