A security flaw has been identified in specific versions of PHP, the programming language that powers many dynamic website features like contact forms, shopping carts, and user accounts. This issue affects PHP 7.3.x versions older than 7.3.13, and PHP 7.4.0, but only when these versions are running on Windows servers.
The flaw is triggered when a website uses PHP's built-in email sending tool to send messages, and passes custom email headers (the metadata that defines details like the sender, subject, and recipient of an email) to that tool written entirely in lowercase letters. A coding error in these affected PHP versions causes certain server memory locations to be improperly freed twice, a type of software error where the same memory block is released more than once.
Source: NVD (National Vulnerability Database) — https://nvd.nist.gov/vuln/detail/CVE-2019-11049
