TI-2020-18603 Aliases CVE-2020-36320 GHSA-42j4-733x-5vcf

Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7

LOW 37CWE-400Published 2021-04-23 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Unsafe validation RegEx in EmailValidator class in com.vaadin:vaadin-server versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Why it matters now

EPSS 0.01956 80th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed com.vaadin:vaadin-bom (Maven): 7.7.22com.vaadin:vaadin-server (Maven): 7.7.22

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Vaadin	Vaadin	7.0.0 and later	—	No fix listed	CNA
Vaadin	vaadin-server	7.0.0 and later	—	No fix listed	CNA
—	com.vaadin:vaadin-bom (Maven)	7.0.0.beta1 to before 7.7.22	7.7.22	Patch available	GHSA-42j4-733x-5vcf
—	com.vaadin:vaadin-server (Maven)	7.0.0.beta1 to before 7.7.22	7.7.22	Patch available	GHSA-42j4-733x-5vcf

Vaadin VendorVaadin Affected 7.0.0 and later Fixed in — No fix listed CNA
vaadin-server VendorVaadin Affected 7.0.0 and later Fixed in — No fix listed CNA
com.vaadin:vaadin-bom (Maven) Vendor— Affected 7.0.0.beta1 to before 7.7.22 Fixed in 7.7.22 Patch available GHSA-42j4-733x-5vcf
com.vaadin:vaadin-server (Maven) Vendor— Affected 7.0.0.beta1 to before 7.7.22 Fixed in 7.7.22 Patch available GHSA-42j4-733x-5vcf

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vaadin:vaadin::::::::	7.0.0 to before 7.7.22	Vulnerable	Vaadin

cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.7.22 Vulnerable ·Vaadin

Remediation

Fix · GHSA-42j4-733x-5vcf com.vaadin:vaadin-bom (Maven) Fixed in 7.7.22 Advisory →
Fix · GHSA-42j4-733x-5vcf com.vaadin:vaadin-server (Maven) Fixed in 7.7.22 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-36320
2026-10-03 Alias added: GHSA-42j4-733x-5vcf

References

Exploit 1

https://github.com/vaadin/framework/issues/7757

Patch 1

https://github.com/vaadin/framework/pull/12104

Advisory 2

Other 1

https://github.com/vaadin/framework/security/advisories/GHSA-42j4-733x-5vcf

TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences