CVE-2026-57584

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57584
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57584.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-57584
Aliases
Published
2026-07-10T21:04:26Z
Modified
2026-10-27T07:33:18Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS
Details

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1333"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57584.json"
}
References

Affected packages

Git / github.com/phalcon/cphalcon

Affected ranges

Type
GIT
Repo
https://github.com/phalcon/cphalcon
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
531127b6a8ea91608d40be111097cc6e60cdad91
Fixed
14ba22d389d5ca620bb9d5207205f836ef1224f2
Fixed
fa798e919cb2c487062bb9899ad6fc2b673b3a67
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.15.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "14ba22d389d5ca620bb9d5207205f836ef1224f2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "fa798e919cb2c487062bb9899ad6fc2b673b3a67"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v5.15.0",
            "range":  [
                {
                    "fixed":  "531127b6a8ea91608d40be111097cc6e60cdad91"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

5.*
5.0.0alpha3
5.12.0
phalcon-v0.*
phalcon-v0.7.0
phalcon-v0.9.0
phalcon-v1.*
phalcon-v1.0.0
phalcon-v1.0.1
phalcon-v1.1.0
phalcon-v1.2.0
phalcon-v1.3.0
phalcon-v1.3.1
phalcon-v1.3.2
phalcon-v1.3.3
phalcon-v1.3.4
phalcon-v2.*
phalcon-v2.0.0
phalcon-v2.0.1
phalcon-v2.0.10
phalcon-v2.0.11
phalcon-v2.0.13
phalcon-v2.0.2
phalcon-v2.0.3
phalcon-v2.0.4
phalcon-v2.0.5
phalcon-v2.0.6
phalcon-v2.0.7
phalcon-v2.0.8
phalcon-v2.0.9
v0.*
v0.7.0
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.2.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.2.1
v3.2.2
v4.*
v4.0.0
v4.0.0-alpha.2
v4.0.0-alpha.3
v4.0.0-alpha.5
v4.0.0-beta.1
v4.0.0-beta.2
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.1.0
v5.*
v5.0.0
v5.0.0-alpha.1
v5.0.0-alpha.2
v5.0.0RC1
v5.0.0RC2
v5.0.0RC3
v5.0.0RC4
v5.0.0alpha3
v5.0.0alpha4
v5.0.0alpha5
v5.0.0alpha6
v5.0.0alpha7
v5.0.0beta1
v5.0.0beta2
v5.0.0beta3
v5.0.1
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.10.0
v5.11.0
v5.11.1
v5.12.1
v5.13.0
v5.14.0
v5.14.1
v5.14.2
v5.2.0
v5.2.1
v5.2.2
v5.2.3
v5.3.0
v5.3.1
v5.4.0
v5.5.0
v5.6.0
v5.6.1
v5.6.2
v5.7.0
v5.8.0
v5.9.0
v5.9.1
v5.9.2
v5.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-57584.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "290327883008703426703071709170091011282",
                "127647345576258058217217133880069422604",
                "52175626408332468339693429871581315717",
                "83399537194116524703830380952247430645"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57584-119327e6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/mvc/router/route.zep.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "310879397834156261784628446262176359869",
                "30817665992525902480652858304205474358",
                "237773488081096496946728126696618862429",
                "95854278242688961470702235286200312823"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57584-66c37d03",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/cli/router/route.zep.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "156722555431988344114354487715969162312",
                "172419622269465501315146396920888200963",
                "146235668562728317862066394794679692501",
                "131535477614207855214660326933439747345"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57584-689ab1b4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/cli/router.zep.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "199120990106499689946260139671396058849",
            "length":  2033
        },
        "id":  "CVE-2026-57584-8086ab6f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/mvc/router.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "171016680314216526848640173591753661644",
                "306758405266137166530954205836660233627",
                "89862765403226228355075577020912785741",
                "156115149186537665158109760755504729020"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57584-83e56e4b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/mvc/router.zep.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "171016680314216526848640173591753661644",
                "306758405266137166530954205836660233627",
                "89862765403226228355075577020912785741",
                "156115149186537665158109760755504729020",
                "290327883008703426703071709170091011282",
                "127647345576258058217217133880069422604",
                "52175626408332468339693429871581315717",
                "83399537194116524703830380952247430645",
                "156722555431988344114354487715969162312",
                "172419622269465501315146396920888200963",
                "146235668562728317862066394794679692501",
                "131535477614207855214660326933439747345",
                "310879397834156261784628446262176359869",
                "30817665992525902480652858304205474358",
                "237773488081096496946728126696618862429",
                "95854278242688961470702235286200312823"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-57584-a43a0ae4",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "build/phalcon/phalcon.zep.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "81881669968940277411086039828445045078",
            "length":  3254
        },
        "id":  "CVE-2026-57584-b2badc2b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "build/phalcon/phalcon.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "81881669968940277411086039828445045078",
            "length":  3254
        },
        "id":  "CVE-2026-57584-b5a91ab0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/mvc/router/route.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "197552185280527165225420079054635167509",
            "length":  1885
        },
        "id":  "CVE-2026-57584-b5ab563e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/cli/router.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "269233386850001892885397547823341831963",
            "length":  4242
        },
        "id":  "CVE-2026-57584-cc290a7f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "ext/phalcon/cli/router/route.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "269233386850001892885397547823341831963",
            "length":  4242
        },
        "id":  "CVE-2026-57584-f172bdde",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "build/phalcon/phalcon.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "199120990106499689946260139671396058849",
            "length":  2033
        },
        "id":  "CVE-2026-57584-f8c0a50a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "build/phalcon/phalcon.zep.c",
            "function":  "PHP_METHOD"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "197552185280527165225420079054635167509",
            "length":  1885
        },
        "id":  "CVE-2026-57584-ffbcd10c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67",
        "target":  {
            "file":  "build/phalcon/phalcon.zep.c",
            "function":  "PHP_METHOD"
        }
    }
]
vanir_signatures_modified 
"2026-10-27T07:33:18Z"