CVE-2026-57584

Name of the Vulnerable Software and Affected Versions Phalcon versions prior to 5.15.0

Description In Phalcon MVC applications using a default router, the CLI router, or the /:params placeholder, a built-in route is registered with a compiled PCRE (Perl Compatible Regular Expressions) pattern containing a nested quantifier. The PhalconMvcRouter::handle() function matches this pattern against the request URI. An attacker can provide a crafted path, such as one containing repeated slashes followed by decoded newlines, to trigger catastrophic backtracking—a condition where the regular expression engine takes an exponential amount of time to process a string—leading to CPU exhaustion or route-matching failure.

Recommendations Update to version 5.15.0.