PT-2026-40943 · Givanz+1 · Vvveb

Basant Kumar + 1 · Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-41935

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.3

Description An uncontrolled recursion issue exists in the admin controller dispatch cycle. The Base::init() function repeatedly invokes the permission() function on error handlers, leading to infinite recursion that exhausts PHP memory limits. A low-privilege user can trigger this by sending sustained requests to forbidden admin URLs, resulting in a denial of service for legitimate traffic by exhausting PHP memory across all workers.

Recommendations Update to version 1.0.8.3 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Uncontrolled Recursion

Weakness Enumeration

CWE-209

CWE-674

Related Identifiers

CVE-2026-41935

Affected Products

Vvveb

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41935.json · Exploit
• https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8 · Patch
• https://osv.dev/vulnerability/CVE-2026-41935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41935 · Security Note
• https://github.com/givanz/Vvveb · Note
• https://github.com/givanz/Vvveb/releases/tag/1.0.8.3 · Note
• https://vulncheck.com/advisories/vvveb-uncontrolled-recursion-denial-of-service · Note