VULNERABILITY INTELLIGENCE

CVE-2026-41935

CVSS score7.1 HIGH
EPSS probability0.27%
CISA KEVNot currently listed
Published2026-05-14
Last modified2026-10-26
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Description

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

Weakness classification

  • CWE-209: Generation of Error Message Containing Sensitive Information
  • CWE-674: Uncontrolled Recursion

Primary references