Home

Description

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

PUBLISHED Reserved 2026-04-22 | Published 2026-05-14 | Updated 2026-05-14 | Assigner VulnCheck




HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

HIGH: 7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Problem types

Uncontrolled Recursion

Generation of Error Message Containing Sensitive Information

Product status

Default status
affected

Any version before 1.0.8.3
affected

c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 (git)
unaffected

Credits

Basant Kumar (@CyberWarrior9) finder

VulnCheck finder

References

github.com/givanz/Vvveb/releases/tag/1.0.8.3 release-notes

github.com/...ommit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 patch

www.vulncheck.com/...ncontrolled-recursion-denial-of-service third-party-advisory

cve.org (CVE-2026-41935)

nvd.nist.gov (CVE-2026-41935)

Download JSON