CVE-2026-57584: Phalcon PHP Framework DoS Vulnerability

CVE-2026-57584 Overview

CVE-2026-57584 is a Regular Expression Denial of Service (ReDoS) vulnerability in the Phalcon PHP framework affecting versions prior to 5.15.0. Every Phalcon MVC application built with the default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.)*. The same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request. A crafted path containing repeated slashes followed by decoded newlines triggers catastrophic backtracking, causing CPU exhaustion or route-matching failure. The issue is classified as [CWE-1333] Inefficient Regular Expression Complexity.

Critical Impact
A single unauthenticated HTTP request with a crafted URI can consume a worker process indefinitely, exhausting CPU resources and rendering the affected application unavailable.

Affected Products

Phalcon cphalcon framework versions prior to 5.15.0
Phalcon MVC applications using the default router
Phalcon CLI applications using the built-in CLI router

Discovery Timeline

2026-07-10 - CVE-2026-57584 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57584

Vulnerability Analysis

The vulnerability resides in the default route pattern registered by Phalcon's MVC and CLI routers. The pattern uses a nested quantifier of the form (/.*)*, which creates ambiguity in how the PCRE engine assigns characters to capturing groups. When the regex engine encounters an input that partially matches but ultimately fails, it explores an exponential number of backtracking paths.

Because Phalcon\Mvc\Router::handle() executes this regex against the request URI on every incoming request, an unauthenticated attacker can trigger the pathological behavior remotely. A crafted URI containing sequences of slashes and decoded newline characters forces the engine into worst-case behavior, pinning a PHP worker at 100% CPU.

Root Cause

The default :params placeholder was compiled to the sub-pattern (/.*)* — an outer star applied to a group that itself contains an unbounded .*. This produces catastrophic backtracking because the same input character can be matched by multiple iterations of the outer group. The fix replaces the outer * with ?, making the group optional rather than repeatable and eliminating the ambiguity.

Attack Vector

Exploitation requires no authentication, no user interaction, and no privileges. An attacker sends a single HTTP request with a crafted URI to any endpoint served by a Phalcon application using the default router. The framework attempts to match the URI against the vulnerable pattern before dispatching to any controller, so no application-level exposure is required.

text

// Vulnerable pattern (MVC router) — before patch
ZVAL_STRING(&_4$$3, "#^/([\\w0-9\\_\\-]+)/([\\w0-9\\.\\_]+)(/.*)*$#u");

// Fixed pattern — after patch
ZVAL_STRING(&_4$$3, "#^/([\\w0-9\\_\\-]+)/([\\w0-9\\.\\_]+)(/.*)?$#u");

Source: GitHub Commit fa798e9

text

// CLI router pattern — before patch
"#^(?::delimiter)?([a-zA-Z0-9\\_\\-]+):delimiter([a-zA-Z0-9\\.\\_]+)(:delimiter.*)*$#"

// CLI router pattern — after patch
"#^(?::delimiter)?([a-zA-Z0-9\\_\\-]+):delimiter([a-zA-Z0-9\\.\\_]+)(:delimiter.*)?$#"

Source: GitHub Commit 14ba22d

Detection Methods for CVE-2026-57584

Indicators of Compromise

HTTP request URIs containing long sequences of repeated / characters followed by URL-encoded newline sequences (%0A, %0D).
PHP-FPM or worker processes sustaining 100% CPU utilization tied to a single request.
Web server timeouts, 504 Gateway Timeout responses, or max_execution_time errors correlating with unusual URI patterns.

Detection Strategies

Inspect access logs for URIs whose length or slash-count exceeds typical application patterns and correlate with elevated request-processing latency.
Deploy WAF rules that reject request paths containing more than a reasonable threshold of consecutive slashes or embedded control characters.
Monitor PCRE engine metrics via pcre.backtrack_limit failures in PHP error logs, which indicate regex engines hitting resource ceilings.

Monitoring Recommendations

Alert on per-request CPU time exceeding a defined baseline for Phalcon-served endpoints.
Track sudden increases in 504 or 502 response codes from upstream Phalcon applications.
Log and review the running Phalcon version on all deployed hosts to identify instances below 5.15.0.

How to Mitigate CVE-2026-57584

Immediate Actions Required

Upgrade the Phalcon extension to version 5.15.0 or later on all hosts running MVC or CLI applications.
Audit deployed applications for use of the default router or the /:params placeholder and confirm the framework version.
Deploy WAF or reverse-proxy rules that limit URI length and reject paths with abnormal repetition of / or embedded newlines until patching completes.

Patch Information

The fix is available in Phalcon 5.15.0, published on GitHub. The patch replaces the outer repetition quantifier * with the optional quantifier ? in the compiled :params pattern for both the MVC and CLI routers, eliminating the nested-quantifier ambiguity. See GitHub Release v5.15.0 and the GitHub Security Advisory GHSA-x7rj-f32v-7jjg.

Workarounds

Replace the default router with an explicit route collection that avoids the /:params placeholder and defines only concrete controller/action patterns.
Set a strict pcre.backtrack_limit in php.ini to cause the regex to fail fast rather than exhaust CPU when a pathological input is supplied.
Enforce a maximum request URI length at the web server (Nginx large_client_header_buffers, Apache LimitRequestLine) to reduce attacker input flexibility.

bash

# php.ini — reduce PCRE backtracking cost as a temporary safeguard
pcre.backtrack_limit = 100000
pcre.recursion_limit = 100000

# nginx.conf — limit request line length
large_client_header_buffers 4 8k;

# Verify Phalcon version after upgrade
php -r "echo Phalcon\\Version::get();"
# Expected output: 5.15.0 or later