Vaadin
Monthly
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaadin-server-mpr-jakarta 8.18.0 through 8.32.1): a request carrying a non-numeric v-uiId parameter makes Integer.parseInt throw inside VaadinService.requestEnd() while the session lock is held, so the lock is never released and the serving thread returns to the pool still owning it. Every subsequent request for that session then blocks indefinitely in VaadinService.lockSession(), and repeating the request exhausts the container thread pool and takes the application down. Exploitation requires no credentials - a session cookie from a single initial request is sufficient - and no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable over HTTP by any client.
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-24, 12.2.0 in Vaadin 25) whose disclosed flaws - prototype pollution through dotted series.keys paths and several DOM-XSS sinks (credits.href, breadcrumbs.style, HTML parsed while printing, and xlink:href in exported charts) - become reachable whenever attacker-controlled data reaches the chart configuration. Applications that pass untrusted input into additionalOptions, updateConfiguration() or markup-bearing text options can be induced to execute script in a victim's browser or, in the Node.js SVG export path, to pollute Object.prototype. Scoring 8.4 (CVSS 4.0) and 9.3-equivalent under the assessed CVSS 3.1 vector, exploitation requires a low-privileged authenticated input path and a victim actively rendering, printing or exporting the chart; no public exploit code has been identified at time of analysis, and because Vaadin pins the Highcharts version, upgrading Highcharts independently does not remove the exposure.
Cross-origin information disclosure in the Vaadin Flow server-push endpoint allows a page on any origin to make a credentialed request to an authenticated user's push endpoint and read the response, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor echoes the request Origin into Access-Control-Allow-Origin while permitting credentials. Exposure is narrow: only applications using @Push over a non-WebSocket (HTTP/long-polling) transport are affected, and reading anything useful beyond triggering the request also requires the target session's push identifier, which is why CVSS 4.0 scores the issue only 2.3 and the priority decision is 'monitor'. No public exploit code was identified at time of analysis and there is no KEV listing or EPSS score in the available data.
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
Vaadin Flow's Maven and Gradle build plugins expose all process-level environment variables - including CI-injected secrets and credentials - in plaintext build logs whenever the frontend build process exits with a non-zero status code. Affected are com.vaadin:flow-maven-plugin, flow-gradle-plugin, and flow-plugin-base across Vaadin 23.0.0-23.6.9, 24.0.0-24.10.3, and 25.0.0-25.1.4. No public exploit code exists and this is not listed in CISA KEV; however, any actor with read access to CI build logs from a failed frontend build can extract plaintext registry credentials, deploy tokens, or signing keys, enabling downstream supply chain compromise consistent with the CVSS SC:H/SI:H subsequent-system impact ratings.
Authentication bypass in Vaadin framework (14.0.0-14.14.0, 23.0.0-23.6.x, and other ranges). The web application framework fails to properly enforce authentication on certain routes.
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 versions up to 14.14.0 is affected by path traversal.
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local. Rated low severity (CVSS 2.5), this vulnerability is no authentication required.
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14),. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version. Rated low severity (CVSS 2.5).
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to. Rated low severity (CVSS 2.5).
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0. Rated low severity (CVSS 2.5).
Unauthenticated remote denial of service in Vaadin Framework 8 (com.vaadin:vaadin-server 8.16.0 through 8.32.1, and vaadin-server-mpr-jakarta 8.18.0 through 8.32.1): a request carrying a non-numeric v-uiId parameter makes Integer.parseInt throw inside VaadinService.requestEnd() while the session lock is held, so the lock is never released and the serving thread returns to the pool still owning it. Every subsequent request for that session then blocks indefinitely in VaadinService.lockSession(), and repeating the request exhausts the container thread pool and takes the application down. Exploitation requires no credentials - a session cookie from a single initial request is sufficient - and no public exploit code or confirmed active exploitation was identified at time of analysis, though the flaw is trivially reachable over HTTP by any client.
Charts rendered by Vaadin Charts across Vaadin 22 through 25.3.0 bundle a pinned Highcharts release (9.2.2 in Vaadin 22-24, 12.2.0 in Vaadin 25) whose disclosed flaws - prototype pollution through dotted series.keys paths and several DOM-XSS sinks (credits.href, breadcrumbs.style, HTML parsed while printing, and xlink:href in exported charts) - become reachable whenever attacker-controlled data reaches the chart configuration. Applications that pass untrusted input into additionalOptions, updateConfiguration() or markup-bearing text options can be induced to execute script in a victim's browser or, in the Node.js SVG export path, to pollute Object.prototype. Scoring 8.4 (CVSS 4.0) and 9.3-equivalent under the assessed CVSS 3.1 vector, exploitation requires a low-privileged authenticated input path and a victim actively rendering, printing or exporting the chart; no public exploit code has been identified at time of analysis, and because Vaadin pins the Highcharts version, upgrading Highcharts independently does not remove the exposure.
Cross-origin information disclosure in the Vaadin Flow server-push endpoint allows a page on any origin to make a credentialed request to an authenticated user's push endpoint and read the response, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor echoes the request Origin into Access-Control-Allow-Origin while permitting credentials. Exposure is narrow: only applications using @Push over a non-WebSocket (HTTP/long-polling) transport are affected, and reading anything useful beyond triggering the request also requires the target session's push identifier, which is why CVSS 4.0 scores the issue only 2.3 and the priority decision is 'monitor'. No public exploit code was identified at time of analysis and there is no KEV listing or EPSS score in the available data.
The Vaadin Spreadsheet component fails to enforce sheet protection when writing cell comments, so any authenticated user of an application that renders a spreadsheet can insert or overwrite comments on a protected sheet - including on cells that are explicitly locked - and can write a comment to a cell that does not yet exist, which creates the underlying row and cell. Only logged-in users of the host application are affected (CVSS v4.0 base 5.3; independent assessment CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to spreadsheet integrity: no confidentiality or availability impact, no user interaction, and low attack complexity. Exploitation requires the Spreadsheet component to actually be rendered, sheet protection to be enabled, and a valid session; no public exploit code or CISA KEV entry is identified at time of analysis. Fixed releases (Vaadin 23.6.14, 24.9.22, 24.10.10, 25.1.12, 25.2.7 and Spreadsheet add-on 3.1.1) are available per the vendor advisory.
Deep-merge prototype pollution in Vaadin Charts and Vaadin Component Base lets remote, unauthenticated attackers write arbitrary properties onto JavaScript's Object.prototype whenever a Vaadin application merges an object it does not control into a chart configuration (e.g. updateConfiguration or a chart series config) or into a component's i18n property. Once injected, those properties are visible to every object in the running client-side application, degrading UI integrity and availability rather than exposing data or yielding direct code execution. Exploitation is conditional - the host application must actually route crafted input containing a __proto__ (or equivalent prototype) key into one of those two merge sinks - and no public exploit code has been identified at time of analysis, with no confirmed active exploitation (CISA KEV). Affected ranges are Vaadin 23.0.0-23.6.13, 24.0.0-24.9.20, 24.10.0-24.10.9, 25.0.0-25.1.11 and 25.2.0-25.2.6 across the Maven artifacts and the corresponding @vaadin/charts and @vaadin/component-base npm packages.
Vaadin Flow's Maven and Gradle build plugins expose all process-level environment variables - including CI-injected secrets and credentials - in plaintext build logs whenever the frontend build process exits with a non-zero status code. Affected are com.vaadin:flow-maven-plugin, flow-gradle-plugin, and flow-plugin-base across Vaadin 23.0.0-23.6.9, 24.0.0-24.10.3, and 25.0.0-25.1.4. No public exploit code exists and this is not listed in CISA KEV; however, any actor with read access to CI build logs from a failed frontend build can extract plaintext registry credentials, deploy tokens, or signing keys, enabling downstream supply chain compromise consistent with the CVSS SC:H/SI:H subsequent-system impact ratings.
Authentication bypass in Vaadin framework (14.0.0-14.14.0, 23.0.0-23.6.x, and other ranges). The web application framework fails to properly enforce authentication on certain routes.
Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 versions up to 14.14.0 is affected by path traversal.
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12,. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Missing output sanitization in test sources in org.webjars.bowergithub.vaadin:vaadin-menu-bar versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Improper check in CheckboxGroup in com.vaadin:vaadin-checkbox-flow versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local. Rated low severity (CVSS 2.5), this vulnerability is no authentication required.
Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14),. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity.
Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version. Rated low severity (CVSS 2.5).
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to. Rated low severity (CVSS 2.5).
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:vaadin-server versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0. Rated low severity (CVSS 2.5).