CVE-2026-57584

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57584", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-24T18:49:56.209Z", "datePublished": "2026-07-10T21:04:26.946Z", "dateUpdated": "2026-07-13T18:04:51.160Z"}, "containers": {"cna": {"title": "Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS", "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "lang": "en", "description": "CWE-1333: Inefficient Regular Expression Complexity", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg"}, {"name": "https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2", "tags": ["x_refsource_MISC"], "url": "https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2"}, {"name": "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67", "tags": ["x_refsource_MISC"], "url": "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67"}, {"name": "https://github.com/phalcon/cphalcon/releases/tag/v5.15.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/phalcon/cphalcon/releases/tag/v5.15.0"}], "affected": [{"vendor": "phalcon", "product": "cphalcon", "versions": [{"version": "< 5.15.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T21:04:26.946Z"}, "descriptions": [{"lang": "en", "value": "Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\\Mvc\\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0."}], "source": {"advisory": "GHSA-x7rj-f32v-7jjg", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-13T18:04:40.467436Z", "id": "CVE-2026-57584", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:04:51.160Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57584", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-13T18:04:40.467436Z"}}}], "references": [{"url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-13T18:04:18.859Z"}}], "cna": {"title": "Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS", "source": {"advisory": "GHSA-x7rj-f32v-7jjg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "phalcon", "product": "cphalcon", "versions": [{"status": "affected", "version": "< 5.15.0"}]}], "references": [{"url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "name": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2", "name": "https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67", "name": "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/phalcon/cphalcon/releases/tag/v5.15.0", "name": "https://github.com/phalcon/cphalcon/releases/tag/v5.15.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\\Mvc\\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333: Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-10T21:04:26.946Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57584", "state": "PUBLISHED", "dateUpdated": "2026-07-13T18:04:51.160Z", "dateReserved": "2026-06-24T18:49:56.209Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-10T21:04:26.946Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cphalcon", "vendor": "phalcon", "versions": [{"status": "affected", "version": "< 5.15.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\\Mvc\\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0."}, {"lang": "es", "value": "Phalcon es un framework PHP de alto rendimiento y pila completa. Antes de la versi\u00f3n 5.15.0, cada aplicaci\u00f3n MVC de Phalcon construida con un router predeterminado registra una ruta incorporada cuyo patr\u00f3n PCRE compilado contiene el cuantificador anidado (/.), y la misma construcci\u00f3n es producida por el marcador de posici\u00f3n /:params y el router CLI. Phalcon\\Mvc\\Router::handle() compara este patr\u00f3n contra la URI de solicitud controlada por el atacante en cada solicitud, por lo que una ruta manipulada, como una que contiene barras repetidas seguida de saltos de l\u00ednea decodificados, puede desencadenar un retroceso catastr\u00f3fico y causar agotamiento de la CPU o fallo en la coincidencia de rutas. Este problema est\u00e1 solucionado en la versi\u00f3n 5.15.0."}], "id": "CVE-2026-57584", "lastModified": "2026-10-25T15:10:00.147", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57584", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-13T18:04:40.467436Z", "version": "2.0.3"}}]}, "published": "2026-07-10T22:16:44.560", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2"}, {"source": "security-advisories@github.com", "url": "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67"}, {"source": "security-advisories@github.com", "url": "https://github.com/phalcon/cphalcon/releases/tag/v5.15.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,5.15.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "cphalcon", "source": "cna", "vendor": "phalcon"}, "product": "cphalcon", "vendor": "phalcon"}], "created": "2026-07-11T10:30:05.144314+00:00", "updated": "2026-07-31T13:00:10.683406+00:00", "vendors": ["phalcon", "phalcon$PRODUCT$cphalcon"]}