CVE-2026-57584
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A vulnerability in Phalcon before version 5.15.0 causes the default MVC router to use a compiled PCRE pattern with a nested quantifier, allowing an attacker to trigger catastrophic backtracking via a crafted request URI containing repeated slashes and newline characters. This leads to CPU exhaustion or route-matching failure.
Risk Assessment
An attacker can remotely overload the server, causing a denial of service (DoS) by sending specially crafted HTTP requests, potentially disrupting application functionality and service availability.
Recommendation
Immediately upgrade Phalcon to version 5.15.0 or later, which includes a fix that prevents catastrophic backtracking.
Other vulnerabilities in Phalcon
See all- CVE-2026-59989Critical
Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.
- CVE-2026-54736High
A vulnerability in Phalcon before version 5.14.1 allows an attacker to exploit a timing side-channel in the Phalcon\Encryption\Crypt::decrypt function, where the HMAC comparison is performed byte-by-byte and returns early on the first mismatch. This enables the attacker to recover a valid HMAC tag byte-by-byte and attach it to a chosen IV and ciphertext, causing decrypt() to accept tampered encrypted content as authentic.
Original NVD description (English source)
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.