CVE-2026-57584— Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57584
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Source: NVD (National Vulnerability Database)
Vulnerability Description
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1333
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-57584
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57584
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57584 (3)
- 🔗 Release v5.15.0 · phalcon/cphalcon · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-57584 (1)
IV. Related Vulnerabilities
Same weakness: CWE-1333
- CVE-2026-59220
Open WebUI: ReDoS in skill-mention regexes causes whole-inst - CVE-2026-55470
HAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeo - CVE-2026-15154
Guardrails-detectors: guardrails-detectors: unauthenticated - CVE-2026-14895
String::Util versions before 1.36 for Perl are susceptible t - CVE-2026-55574
vLLM: ReDoS via structured_outputs.regex compiled without ti
V. Comments for CVE-2026-57584
No comments yet