CVE-2026-57584

Received Received - Intake

Phalcon Framework Regex Catastrophic Backtracking Flaw

Publication date: 2026-07-10

Last updated on: 2026-07-10

Assigner: GitHub, Inc.

Description

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-10

Last Modified

2026-07-10

Generated

2026-07-11

AI Q&A

2026-07-11

EPSS Evaluated

N/A

NVD

CVE-2026-57584

Affected Vendors & Products

Vendor	Product	Version / Range
phalcon	phalcon	5.15.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Phalcon PHP framework versions prior to 5.15.0. The default router in these versions registers a built-in route with a compiled PCRE pattern containing a nested quantifier. When the Phalcon\Mvc\Router::handle() method matches this pattern against an attacker-controlled request URI, a specially crafted path with repeated slashes and decoded newlines can cause catastrophic backtracking.

Catastrophic backtracking leads to excessive CPU usage or failure in route matching, which can disrupt the normal operation of the application.

This issue was fixed in version 5.15.0 of Phalcon.

Impact Analysis

An attacker can exploit this vulnerability by sending specially crafted requests that cause the router to perform catastrophic backtracking, leading to CPU exhaustion.

This can result in denial of service conditions where the application becomes unresponsive or fails to correctly match routes, potentially disrupting service availability.

Mitigation Strategies

The vulnerability is fixed in Phalcon version 5.15.0. Immediate mitigation involves upgrading your Phalcon MVC applications to version 5.15.0 or later.

Hi! I’m here to help you understand CVE-2026-57584. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70