Security readout for executives and security teams
Plain-English summary
A low-privilege Vvveb user can repeatedly request restricted administration pages and force the server into an endless processing loop. This consumes PHP memory and can disable all available workers, making the website unavailable to legitimate users. Vvveb versions before 1.0.8.3 are affected.
Executive priority
Treat this as a high-priority availability risk. Internet-accessible administration interfaces and environments issuing low-privilege accounts should be upgraded first. Although active exploitation is not established, successful abuse could interrupt customer-facing services by exhausting all PHP workers.
Technical view
The administration controller dispatch cycle allows Base::init() to repeatedly invoke permission() while processing error handlers. This uncontrolled recursion continues until PHP memory limits are exhausted. Sustained authenticated requests can consume every PHP worker, producing a remotely triggered denial of service. The CVSS 4.0 score is 7.1.
Likely exposure
Exposure is highest where a Vvveb administration interface running a version before 1.0.8.3 is network-accessible and attackers can obtain low-privilege accounts. Exploitation requires authentication but no user interaction, according to the supplied CVSS vector.
Exploitation context
The supplied record is not listed in CISA KEV and provides no evidence of active exploitation. Nevertheless, the described attack has low complexity and requires only low privileges, making service disruption plausible where vulnerable administration endpoints and accounts are accessible.
Researcher notes
The primary weakness is CWE-674 uncontrolled recursion; the record also maps CWE-209. The supplied affected-version metadata is sparse, so exact build exposure should be verified against the 1.0.8.3 release and referenced patch commit. No public exploitation evidence is included in the source bundle.
Mitigation direction
- Upgrade Vvveb to version 1.0.8.3 or later using the vendor release guidance.
- Confirm the deployed build includes commit c766e84b479dcf1bd1f25a44e4b9c9fa450769c8.
- Temporarily limit administration-interface access to trusted users and networks until upgrading.
- Monitor PHP worker memory and availability for signs of resource exhaustion.
Validation and detection
- Inventory every Vvveb deployment and record its installed version or commit identifier.
- Verify no deployment remains on a version earlier than 1.0.8.3.
- Review logs for repeated requests to forbidden administration URLs from authenticated accounts.
- Check monitoring history for PHP memory exhaustion, worker termination, or unexplained availability loss.
- After upgrading, confirm normal permission-error handling without abnormal worker memory growth.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-209: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-674: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-41935 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H2.84.2VulnCheckVulnerability scoring details
Base CVSS 4.0 score
7.1HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/givanz/Vvveb/releases/tag/1.0.8.3CVE reference, VulnCheck · release-notes
- https://github.com/givanz/Vvveb/commit/c766e84b479dcf1bd1f25a44e4b9c9fa450769c8CVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/vvveb-uncontrolled-recursion-denial-of-serviceCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Generation of Error Message Containing Sensitive Information
Generation of Error Message Containing Sensitive Information represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Uncontrolled Recursion
Uncontrolled Recursion represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.