CVE-2019-11049
mail() may release string with refcount==1 twice
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
mail() may release string with refcount==1 twice
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
- Record
CVE-2019-11049- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
EUVDEUVD-2019-2757
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
- Record
EUVD-2019-2757- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h3jj-5ghg-r32j
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail()...
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
- Record
GHSA-h3jj-5ghg-r32j- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-415
- Updated
- 2026-11-02
NVD
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
- Record
CVE-2019-11049- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-415
- Updated
- 2026-11-02
OSVBELL-CVE-2019-11049
CVE-2019-11049 does not affect BellSoft software
- Record
BELL-CVE-2019-11049- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
In PHP versions 7.3.x below 7.3.13 and 7.4.0 on Windows, when supplying custom headers to mail() function, due to mistake introduced in commit 78f4b4a2dcf92ddbccea1bb95f8390a18ac3342e, if the header is supplied in lowercase, this can result in double-freeing certain memory locations.
- Record
CVE-2019-11049- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0412 No score
Updated php packages fix security vulnerabilities
Updated php packages fix security vulnerabilities:
DirectoryIterator class silently truncates after a null byte (CVE-2019-11045).
Buffer underflow in bc_shift_addsub). (CVE-2019-11046)
Heap-buffer-overflow READ in exif. (CVE-2019-11047)
mail() may release string with refcount==1 twice. (CVE-2019-11049)
Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050)
For other fixes, see the referenced changelog.
- Record
MGASA-2019-0412- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
phpMageia:7 From an advisory covering 5 CVEs |
before 7.3.13-1.mga7 | 7.3.13-1.mga7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11049 is a medium vulnerability (CVSS 6.5) in Php, published December 23, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.22%, the 91st percentile. No source names a fixed version.
References
bugs.php.net/bug.php?id=78943
security.netapp.com/advisory/ntap-20200103-0002
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N7GCOAE6KVHYJ3UQ4KLPLTGSLX6IRVRN
seclists.org/bugtraq/2020/Feb/27
debian.org/security/2020/dsa-4626
Show 9 moreShow less
tenable.com/security/tns-2021-14
nvd.nist.gov/vuln/detail/CVE-2019-11049
github.com/advisories/GHSA-h3jj-5ghg-r32j
docs.bell-sw.com/security/cves/CVE-2019-11049
advisories.mageia.org/MGASA-2019-0412.html
bugs.mageia.org/show_bug.cgi?id=25894
php.net/ChangeLog-7.php