phalcon/cphalcon Security Advisories | GitStock

high2026-08-28

Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

GHSA-x7rj-f32v-7jjg · CVE-2026-57584

high2026-08-28

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

GHSA-8jqh-95g6-7jpj · CVE-2026-54736

critical2026-08-21

Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

GHSA-hrwp-4hh9-c8r8 · CVE-2026-59989