CyberRota Analysis
AI-GeneratedPhalcon MVC applications prior to version 5.15.0 are vulnerable to a denial-of-service attack due to a flaw in the default router's handling of nested quantifiers in regular expressions. An attacker can exploit this vulnerability by crafting specific request URIs, leading to CPU exhaustion and potential service disruption. Developers and organizations using affected versions of the Phalcon framework should prioritize upgrading to version 5.15.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier (/.), and the same construct is produced by the /:params placeholder and the CLI router. Phalcon\Mvc\Router::handle() matches this pattern against the attacker-controlled request URI on every request, so a crafted path such as one containing repeated slashes followed by decoded newlines can trigger catastrophic backtracking and cause CPU exhaustion or route-matching failure. This issue is fixed in version 5.15.0.