CVE-2026-54736highCWE-208CWE-347

CVE-2026-54736: falha de alta gravidade em phalcon cphalcon

Phalcon: Non-constant-time HMAC verification in `Encryption\Crypt::decrypt` (timing side-channel)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar cphalcon+ Monitorar phalcon/cphalcon

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.2%
Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the attacker-supplied HMAC tag against the freshly computed HMAC using PHP/Zephir identity comparison, which lowers to a byte-wise comparison that returns early on the first differing byte. This observable timing discrepancy can allow an attacker to recover a valid tag byte-by-byte and attach it to a chosen IV and ciphertext so that decrypt() accepts tampered encrypted content as authentic. This issue is fixed in version 5.14.1.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
phalcon · cphalcon
CVEs relacionadas — phalcon cphalcon

No mesmo produto, das mais perigosas para as menos.

CVE-2026-59989CRITICALPhalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)EPSS 0.5%CVE-2026-57584HIGHPhalcon: Catastrophic backtracking (ReDoS) in the default Phalcon Router route lead to remote unauthenticated DoSEPSS 0.5%