Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

phalcon/cphalcon

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
3 · 1 critical, 2 high
Registry
Packagist

Advisories 3

  • CVE-2026-59989Critical 9.2

    Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

    Affected: fixed in 5.16.0.

  • Phalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoS

    Affected: fixed in 5.15.0.

  • Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

    Affected: fixed in 5.14.1.