CVE-2026-57584: Phalcon ReDoS in default MVC and CLI router patterns

CVE-2026-57584 · Severity: high · CVSS 4 · Published 2026-07-10

Phalcon's default HTTP router contains a regular expression with catastrophic backtracking vulnerability that processes every incoming web request. An attacker can send a short, specially crafted URL to cause the router to consume excessive CPU time, exhausting server capacity and degrading service for legitimate users. This can be exploited without authentication and affects all applications using Phalcon's default configuration.

Technologies: phalcon/cphalcon (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-57584 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57584 being exploited in the wild.
How severe is CVE-2026-57584?
High severity, with a CVSS score of 4, published 10 July 2026.
Which products and versions are affected?
phalcon/cphalcon (Packagist) <= 5.14.2, ECOSYSTEM:introduced=0,fixed=5.15.0; Phalcon Cphalcon < 5.15.0.
Is there a fix for CVE-2026-57584?
Yes. phalcon/cphalcon (Packagist): upgrade to 5.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57584 attacked?
It is attacked over the network.
Am I affected by CVE-2026-57584?
Check whether you run phalcon/cphalcon (Packagist) or Phalcon Cphalcon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • phalcon/cphalcon (Packagist): upgrade to 5.15.0 or later
    composer require phalcon/cphalcon:^5.15.0

Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) caused by a nested quantifier `(/.*)*` in the default route pattern `#^/([\w0-9\_\-]+)/([\w0-9\.\_]+)(/.*)*$#u`. The pattern's group body `(/.*`) overlaps itself because `.` matches `/`, causing exponential backtracking when the regex engine cannot satisfy the anchored `$` anchor. This occurs in four locations: MVC Router default route, /:params placeholder expansion, CLI Router default route, and CLI Router /:params expansion. On every HTTP request, `Router::handle()` calls `preg_match()` with this pattern against the attacker-controlled request URI. In the default MVC configuration, the URI is read from `$_GET["_url"]` which PHP URL-decodes, allowing payloads like `/a/a` followed by slashes and `%0a%0a` (decoded newlines) to trigger the backtracking. A ~40-byte request can pin a CPU core for seconds to minutes depending on PCRE configuration; under default PHP settings with JIT enabled and backtrack_limit=1,000,000, hundreds of concurrent requests saturate workers with ~1ms overhead per request. Patch available in version 5.15.0.

Affected products

  • Phalcon cphalcon <= 5.14.2

Identifiers

  • CVE-2026-57584
  • GHSA-x7rj-f32v-7jjg

Timeline

  • 2026-06-29: disclosed
  • 2026-08-28: advisory
  • 2026-07-10: patched: Version 5.15.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.