Which versions of Phalcon Framework are affected by CVE-2026-57584?

Phalcon PHP framework versions before 5.15.0 contain a denial-of-service vulnerability that allows unauthenticated attackers to take Phalcon-based applications offline by sending specially crafted…. A patch is available.

Is there a public PoC exploit available for CVE-2026-57584?

Yes, a public proof-of-concept exploit is available for CVE-2026-57584. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-57584?

Within 24 hours: Identify all Phalcon PHP deployments and confirm versions; implement WAF rules blocking URIs with consecutive slashes and encoded newline characters; enable request rate limiting at load balancer. Within 7 days: Deploy reverse proxy request path normalization; establish upgrade plan to Phalcon 5.15.0. Within 30 days: Complete upgrade to Phalcon 5.15.0 or later once released; validate patch effectiveness; retire interim controls.

Phalcon Framework CVE-2026-57584

Q: What is the CVSS score of CVE-2026-57584?

CVE-2026-57584 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-43098 HIGH

Inefficient Regular Expression Complexity (ReDoS) (CWE-1333)

2026-07-10 GitHub_M

GHSA-x7rj-f32v-7jjg

PHP Denial Of Service Suse Cphalcon Phalcon

8.7

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote unauthenticated low-complexity request hits the default router on every request (AV:N/AC:L/PR:N/UI:N); impact is pure availability via CPU exhaustion, so C:N/I:N/A:H and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 10, 2026 - 23:02 EUVD

Analysis Generated

Jul 10, 2026 - 21:50 vuln.today

DescriptionCVE.org

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.

AnalysisAI

Regular-expression denial of service (ReDoS) in the Phalcon PHP framework before 5.15.0 lets remote unauthenticated attackers exhaust server CPU by sending a crafted request URI. Every default MVC application registers a built-in route whose compiled PCRE pattern contains a nested quantifier that Router::handle() evaluates against the raw request path on every request, so a path with repeated slashes followed by decoded newlines triggers catastrophic backtracking. There is no public exploit identified at time of analysis, and the CVSS 4.0 score of 8.7 reflects a high availability impact with no confidentiality or integrity effect.

Technical ContextAI

Phalcon is a full-stack PHP framework delivered as a compiled C extension (cphalcon) for high performance. The flaw is a CWE-1333 Inefficient Regular Expression Complexity: the default router, the /:params placeholder, and the CLI router all compile route definitions into a PCRE pattern that includes a nested quantifier of the form (/.)*-style construction. When Phalcon\Mvc\Router::handle() matches this pattern against attacker-controlled input, certain inputs cause exponential-time backtracking in the PCRE engine. Because route matching runs on every incoming HTTP request in a default configuration, the vulnerable code path is reached without any application-specific routing logic being required. The affected product per CPE is cpe:2.3:a:phalcon:cphalcon:*:*:*:*:*:*:*:* for all versions prior to 5.15.0.

RemediationAI

Vendor-released patch: upgrade cphalcon to version 5.15.0 or later, which rewrites the vulnerable route pattern to remove the nested quantifier (fix commits 14ba22d389d5ca620bb9d5207205f836ef1224f2 and fa798e919cb2c487062bb9899ad6fc2b673b3a67; advisory GHSA-x7rj-f32v-7jjg at https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg). Because Phalcon is a compiled PHP extension, applying the fix requires rebuilding or reinstalling the extension and restarting PHP-FPM/the web server, not just a Composer update. If immediate upgrade is not possible, place a reverse proxy or WAF rule in front of the application to reject request paths containing repeated slash sequences or encoded newline characters, and enforce request-path length limits; note this can break legitimate URLs that use encoded characters and does not cover the CLI router. Setting a strict PHP max_execution_time and per-request CPU limits reduces the blast radius of a single malicious request but does not prevent volumetric abuse.