PHP-FPM Path Info Buffer Underflow - Remote Code Execution
CVE-2019-11043
Verified
Description
In PHP-FPM before 7.1.33, 7.2.x before 7.2.24, and 7.3.x before 7.3.11, when deployed in certain Nginx configurations with the fastcgi_split_path_info directive, a crafted request with an empty PATH_INFO can trigger a buffer underflow in the php-fpm code. This may allow an unauthenticated remote attacker to execute arbitrary code through specially crafted URLs by manipulating the PATH_INFO, leading to potential remote code execution. This template checks for the presence of the vulnerable misconfiguration without performing exploitation.
Severity
Critical
CVSS Score
9.8
Exploit Probability
100%
Affected Product
php
Published Date
July 14, 2026
Template Author
prasath from securin labs (https://securin.io)
CVE-2019-11043.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2019-11043
CWE ID:
cwe-119
Remediation Steps
Upgrade PHP to 7.1.33, 7.2.24, 7.3.11 or later. As mitigation, remove the fastcgi_split_path_info directive or ensure it cannot match an empty PATH_INFO.