PT-2026-40943 · Givanz · Vvveb

Basant Kumar + 1 · Publicado 2026-05-14 · Atualizado 2026-05-14 · CVE-2026-41935

Mitre

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

Correção

Uncontrolled Recursion

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-674

CWE-209

Identificadores relacionados

CVE-2026-41935

Produtos afetados

Vvveb

Referências · 4

• https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 · Correção
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-41935 · Nota de Segurança
• https://vulncheck.com/advisories/vvveb-uncontrolled-recursion-denial-of-service · Nota