Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...

GHSA-X7RJ-F32V-7JJG Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

Summary Every Phalcon MVC application built with a default router new Phalcon\Mvc\Router or new Phalcon\Mvc\Routertrue, which is the normal case registers a built-in route whose compiled PCRE pattern is ^/\w0-9\-+/\w0-9.+/.$u. The trailing /. is a nested quantifier whose group body /. overlaps...

EUVD-2026-43098

Phalcon: Catastrophic backtracking ReDoS in the default Phalcon Router route lead to remote unauthenticated DoS...

EUVD-2026-43097

Phalcon: Non-constant-time HMAC verification in Encryption\Crypt::decrypt timing side-channel...

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Summary Phalcon\Encryption\Crypt provides authenticated encryption: when useSigning is enabled the default, encrypt appends an HMAC tag and decrypt verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshly computed HMAC using PHP/Zephir...

GHSA-8JQH-95G6-7JPJ Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Summary Phalcon\Encryption\Crypt provides authenticated encryption: when useSigning is enabled the default, encrypt appends an HMAC tag and decrypt verifies it before returning the plaintext. The verification compares the attacker-supplied tag against the freshly computed HMAC using PHP/Zephir...

CVE-2026-59989

creationtimestamp| type| source ---|---|--- 2026-08-21 22:07:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtmriifpph2p 2026-08-21 22:35:15+00:00| published-proof-of-concept| https://github.com/phalcon/cphalcon/security/advisories/GHSA-hrwp-4hh9-c8r8 2026-08-21 23:20:05+00:0...

CVE-2026-59989

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

GHSA-HRWP-4HH9-C8R8 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

Summary The Volt template compiler in Phalcon generates the PHP for the join filter by string-concatenating the filter's raw template-literal argument bytes with no escaping. The separator literal is dropped verbatim between two single quotes the compiler emits, and the piped array argument is...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-59989 Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-59989

Phalcon (PHP framework) versions 5.15.0 and earlier are vulnerable to a Server-Side Template Injection (SSTI) in the Volt compiler's join filter. The root cause is in resolveFilter within phalcon/Mvc/View/Engine/Volt/Compiler.zep, which inserts raw separator and array token values directly into g...

EUVD-2026-64140

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

CVE-2026-59989: Improper Control of Generation of Code

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

PT-2026-79456

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression. An attacker who can...

SUSE CVE-2026-54736

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first...

SUSE CVE-2026-57584

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier /., and the same construct is produced by the /:params placeholder and the CLI...

CVE-2026-57584

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a default router registers a built-in route whose compiled PCRE pattern contains the nested quantifier /., and the same construct is produced by the /:params placeholder and the CLI...