EUVD-2026-336107

fkie_cve-2026-57584

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.

GHSA-x7rj-f32v-7jjg — Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Affected: Packagist: phalcon/cphalcon

## Summary

Every Phalcon MVC application built with a default router (`new Phalcon\Mvc\Router()` or `new Phalcon\Mvc\Router(true)`, which is the normal case) registers a built-in route whose compiled PCRE pattern is `#^/([\w0-9\_\-]+)/([\w0-9\.\_]+)(/.*)*$#u`. The trailing `(/.*)*` is a nested quantifier whose group body (`/.*`) overlaps itself (`.` matches `/`, and there is no `s`/DOTALL flag), so when the final `$` is forced to fail the engine explores roughly `2^(N/2)` ways to split a run of `N` slashes, causing classic catastrophic backtracking. `Phalcon\Mvc\Router::handle()` runs on **every** request and matches this pattern against the attacker-controlled request URI, so a single short request can burn seconds-to-minutes of CPU per request. The same `(/.*)*` construct is also produced by the `/:params` placeholder (`Phalcon\Mvc\Router\Route::compilePattern()`) and by the CLI router (`Phalcon\Cli\Router` / `Phalcon\Cli\Router\Route`).

## Details

The vulnerable pattern is emitted in four places, all carrying the same `*` nested quantifier:

- Default MVC route registration `phalcon/Mvc/Router.zep` (`Router::__construct()`): `"#^/([\\w0-9\\_\\-]+)/([\\w0-9\\.\\_]+)(/.*)*$#u"`, with paths `["controller": 1, "action": 2, "params": 3]`. - `/:params` placeholder expansions `phalcon/Mvc/Router/Route.zep` (`Route::compilePattern()`): `str_replace("/:params", "(/.*)*", pattern)`. - Default CLI route `phalcon/Cli/Router.zep` (`Router::__construct()`): `"#^(?::delimiter)?([a-…

Most recent entries from all

EUVD-2026-336107

fkie_cve-2026-57584

GHSA-x7rj-f32v-7jjg — Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS