CVE-2026-57584

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.

CVSS

No CVSS.

References

Link	Resource
https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2
https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67
https://github.com/phalcon/cphalcon/releases/tag/v5.15.0
https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg
https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg

Configurations

No configuration.

History

25 Oct 2026, 15:10

Type	Values Removed	Values Added
Summary		(es) Phalcon es un framework PHP de alto rendimiento y pila completa. Antes de la versión 5.15.0, cada aplicación MVC de Phalcon construida con un router predeterminado registra una ruta incorporada cuyo patrón PCRE compilado contiene el cuantificador anidado (/.), y la misma construcción es producida por el marcador de posición /:params y el router CLI. Phalcon\Mvc\Router::handle() compara este patrón contra la URI de solicitud controlada por el atacante en cada solicitud, por lo que una ruta manipulada, como una que contiene barras repetidas seguida de saltos de línea decodificados, puede desencadenar un retroceso catastrófico y causar agotamiento de la CPU o fallo en la coincidencia de rutas. Este problema está solucionado en la versión 5.15.0.

Information

Published : 2026-07-10 22:16

Updated : 2026-10-25 15:10

NVD link : CVE-2026-57584

Mitre link : CVE-2026-57584

CVE.ORG link : CVE-2026-57584

JSON object : View

Products Affected

No product.

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-57584", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57584", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:04:40.467436Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "phalcon", "product": "cphalcon", "versions": [{"status": "affected", "version": "< 5.15.0"}]}]}], "published": "2026-07-10T22:16:44.560", "references": [{"url": "https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2", "source": "security-advisories@github.com"}, {"url": "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67", "source": "security-advisories@github.com"}, {"url": "https://github.com/phalcon/cphalcon/releases/tag/v5.15.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "source": "security-advisories@github.com"}, {"url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\\Mvc\\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0."}, {"lang": "es", "value": "Phalcon es un framework PHP de alto rendimiento y pila completa. Antes de la versi\u00f3n 5.15.0, cada aplicaci\u00f3n MVC de Phalcon construida con un router predeterminado registra una ruta incorporada cuyo patr\u00f3n PCRE compilado contiene el cuantificador anidado (/.), y la misma construcci\u00f3n es producida por el marcador de posici\u00f3n /:params y el router CLI. Phalcon\\Mvc\\Router::handle() compara este patr\u00f3n contra la URI de solicitud controlada por el atacante en cada solicitud, por lo que una ruta manipulada, como una que contiene barras repetidas seguida de saltos de l\u00ednea decodificados, puede desencadenar un retroceso catastr\u00f3fico y causar agotamiento de la CPU o fallo en la coincidencia de rutas. Este problema est\u00e1 solucionado en la versi\u00f3n 5.15.0."}], "lastModified": "2026-10-25T15:10:00.147", "sourceIdentifier": "security-advisories@github.com"}