Phalcon Framework EUVD-2026-43098

No special conditions - remote unauthenticated exploitation against default configurations of Phalcon MVC applications, since the vulnerable built-in route is registered automatically by the default router and Router::handle() evaluates it on every request. The concrete trigger is a request URI containing repeated slashes followed by decoded newline characters that force nested-quantifier backtracking; the /:params placeholder and the CLI router produce the same vulnerable pattern. Exploitation is limited to Phalcon versions prior to 5.15.0, and applications that fully replace the default router with custom non-vulnerable route patterns may not reach the affected code path; impact is confined to availability (CPU exhaustion / route-matching failure) with no data exposure.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) is internally consistent with the description: a remote, unauthenticated, low-complexity request against the default configuration produces a high availability impact and no confidentiality or integrity impact - a pure denial-of-service. No EPSS score, KEV listing, or public POC was provided, so real-world exploitation pressure cannot be confirmed from the data; the absence of KEV means it is not confirmed actively exploited, and the absence of POC means no public exploit is identified. Despite the high 8.7 score, the practical risk is bounded: the only outcome is service degradation or route-matching failure, not code execution or data loss, and a single vulnerable request can be repeated to sustain CPU exhaustion. This is a genuine priority for internet-facing Phalcon deployments because the trigger is trivial and hits default configurations, but it should be triaged as an availability/resilience issue rather than a compromise risk.

An attacker identifies an internet-facing site running a Phalcon MVC application and sends HTTP requests whose URI contains many repeated slashes followed by decoded newline characters, forcing the router's PCRE engine into catastrophic backtracking. Each request pins a worker at high CPU, and by issuing a modest stream of such requests the attacker exhausts the available PHP-FPM workers and renders the site unresponsive. No authentication, user interaction, or non-default configuration is needed, though no public POC was provided in the source data.