A catastrophic backtracking regular‑expression denial of service flaw (CWE‑1333) is present in the default router of the Phalcon MVC framework before version 5.15.0. The router compiles a PCRE pattern containing a nested quantifier, which is also replicated by the "/:params" placeholder and the CLI router. When an attacker supplies a request URI with numerous repeated slashes or encoded newlines, the pattern can trigger exponential backtracking, exhausting the server’s CPU or preventing any route from being matched. The flaw therefore can be leveraged to disrupt the availability of the application for legitimate users.

All PHP applications built with the Phalcon MVC framework that use the default router and run a version earlier than 5.15.0 are vulnerable. The issue is fixed in Phalcon release 5.15.0 and later.

The CVSS score of 8.7 reflects high severity. EPSS < 1% indicates a very low yet nonzero probability of active exploitation. The flaw is not listed in the CISA KEV catalog. The likely attack vector is via an HTTP request to the application, requiring only a crafted URL; no authentication is necessary. Successful exploitation causes CPU exhaustion or failure to resolve routes, effectively denying service to legitimate users.