Collected research

PHP-FPM RCE(CVE-2019-11043)

An analysis and thought about recently PHP-FPM RCE (CVE-2019-11043)

Orange Tsai · Orange Tsai · 29 October 2019

A newline in the URI makes nginx pass an empty PATH_INFO to PHP-FPM, so a pointer calculation underflows and writes a null byte before the buffer, corrupting the FastCGI environment allocator. A following putenv then overwrites a hash-colliding fake request header with PHP_VALUE, letting an unauthenticated attacker set php.ini directives and run commands.

Record

Document

An analysis and thought about recently PHP-FPM RCE (CVE-2019-11043)

Researcher

Orange Tsai

Published by

Orange Tsai

Date

29 October 2019

Topic

Server

In the archive

• Collected in the 2019 research round

Related sources

• Original exploit
• Original PHP-FPM vulnerability report

Tags

• php
• rce
• url-parsing
• reverse-proxy
• cve
• attack-chain

This page is the archive's own catalogue record. The research is the work of Orange Tsai, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.