CVE-2026-41935 Details

A denial-of-service vulnerability has been identified in Vvveb versions prior to 1.0.8.3. The issue arises from an uncontrolled recursion in the admin controller dispatch cycle, where the Base::init() method repeatedly calls the permission() function on error handlers. This loop creates infinite recursion, exhausting PHP memory limits and disrupting normal service. Attackers can exploit this vulnerability by sending repeated requests to restricted admin URLs from a low-privilege account, overwhelming PHP memory on all workers and causing service disruptions for legitimate users.

Users can upgrade to Vvveb version 1.0.8.3 or later to address this vulnerability.