Threat Intelligence Database

CVE-2026-57584 is a high-severity vulnerability in the Phalcon PHP framework prior to version 5.15.0. It involves inefficient regular expression complexity in the default router, where nested quantifiers in the compiled PCRE pattern can lead to catastrophic backtracking. This occurs when the router matches attacker-controlled request URIs containing crafted paths with repeated slashes and decoded newlines, potentially causing CPU exhaustion or route-matching failure. The issue is resolved in Phalcon version 5.15.0.

Phalcon cphalcon versions prior to 5.14.1 contain a timing discrepancy vulnerability in the Crypt::decrypt function. The vulnerability arises because the HMAC tag comparison uses a byte-wise identity check that returns early on the first differing byte, allowing attackers to recover a valid tag byte-by-byte. This can enable attackers to craft tampered encrypted content that decrypt() accepts as authentic. The issue is fixed in version 5.14.1.