Junglewise Threat Intelligence

CVE-2026-57584: Phalcon ReDoS in default MVC and CLI router patterns

CVE-2026-57584 · Severity: high · CVSS 8.7 · Published 2026-07-10

Executive brief

Phalcon's default HTTP router contains a regular expression with catastrophic backtracking vulnerability that processes every incoming web request. An attacker can send a short, specially crafted URL to cause the router to consume excessive CPU time, exhausting server capacity and degrading service for legitimate users. This can be exploited without authentication and affects all applications using Phalcon's default configuration.

Technical details

The vulnerability is a ReDoS (Regular Expression Denial of Service) caused by a nested quantifier `(/.*)*` in the default route pattern `#^/([\w0-9\_\-]+)/([\w0-9\.\_]+)(/.*)*$#u`. The pattern's group body `(/.*`) overlaps itself because `.` matches `/`, causing exponential backtracking when the regex engine cannot satisfy the anchored ` Junglewise anchor. This occurs in four locations: MVC Router default route, /:params placeholder expansion, CLI Router default route, and CLI Router /:params expansion. On every HTTP request, `Router::handle()` calls `preg_match()` with this pattern against the attacker-controlled request URI. In the default MVC configuration, the URI is read from `$_GET["_url"]` which PHP URL-decodes, allowing payloads like `/a/a` followed by slashes and `%0a%0a` (decoded newlines) to trigger the backtracking. A ~40-byte request can pin a CPU core for seconds to minutes depending on PCRE configuration; under default PHP settings with JIT enabled and backtrack_limit=1,000,000, hundreds of concurrent requests saturate workers with ~1ms overhead per request. Patch available in version 5.15.0.

Affected products

  • Phalcon cphalcon <= 5.14.2

Timeline

  • 2026-06-29: disclosed
  • 2026-08-28: advisory
  • 2026-07-10: patched: Version 5.15.0 released with fix

References

Related threats