A catastrophic backtracking regular‑expression denial of service exists in the default Phalcon Router route (CWE‑1333). The router compiles a PCRE pattern that contains a nested quantifier, which is reproduced by the "/:params" placeholder and the CLI router. An attacker can send a crafted URI containing many repeated slashes and decoded newlines, triggering exponential backtracking that exhausts CPU resources or forces route‑matching failure. The vulnerability provides no authentication or privilege requirements, allowing an unauthenticated attacker to raise a denial‑of‑service.

All PHP applications built with the Phalcon MVC framework and using the default router are affected. The issue is resolved in version 5.15.0; earlier versions contain the problematic regular‑expression. The affected product is Phalcon, specifically the "cphalcon" library that ships with all framework builds.

The CVSS score of 8.7 classifies this issue as high severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, through HTTP requests to the server. Exploitation requires only a crafted request URL; no authentication is needed. Successful attack would lead to CPU exhaustion or failure to process legitimate requests, effectively denying service to legitimate users.