Packagist/phalcon/cphalcon CVE-2026-57584: high, EPSS 0.52%

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Action: Upgrade phalcon/cphalcon to 5.15.0 or later.

composer require phalcon/cphalcon:5.15.0

Affected

Fixed versions

Sources

• osv: GHSA-x7rj-f32v-7jjg
• https://github.com/phalcon/cphalcon/security/advisories/GHSA-x7rj-f32v-7jjg
• https://nvd.nist.gov/vuln/detail/CVE-2026-57584
• https://github.com/phalcon/cphalcon/commit/14ba22d389d5ca620bb9d5207205f836ef1224f2
• https://github.com/phalcon/cphalcon/commit/fa798e919cb2c487062bb9899ad6fc2b673b3a67
• https://github.com/phalcon/cphalcon
• https://github.com/phalcon/cphalcon/releases/tag/v5.15.0

CVE-2026-57584 · published 2026-08-28T16:06:31Z · modified 2026-08-28T16:15:06.433556474Z · JSON