Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Priority LOW 18CWE-208Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-208.
Summary
Non-constant-time comparison of CSRF tokens in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.
Why it matters now
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Fixed com.vaadin:flow-server (Maven): 1.0.14, 2.4.7, 5.0.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Vaadin | Vaadin | 10.0.0 and later | — | No fix listed | CNA |
| Vaadin | flow-server | 1.0.0 and later | — | No fix listed | CNA |
| — | com.vaadin:flow-server (Maven) | 1.0.0 to before 1.0.14 | 1.0.14 | Patch available | GHSA-xwg3-qrcg-w9x6 |
| — | com.vaadin:flow-server (Maven) | 1.1.0 to before 2.4.7 | 2.4.7 | Patch available | GHSA-xwg3-qrcg-w9x6 |
| — | com.vaadin:flow-server (Maven) | 3.0.0 to before 5.0.3 | 5.0.3 | Patch available | GHSA-xwg3-qrcg-w9x6 |
- Vaadin VendorVaadin Affected 10.0.0 and later Fixed in — No fix listed CNA
- flow-server VendorVaadin Affected 1.0.0 and later Fixed in — No fix listed CNA
- com.vaadin:flow-server (Maven) Vendor— Affected 1.0.0 to before 1.0.14 Fixed in 1.0.14 Patch available GHSA-xwg3-qrcg-w9x6
- com.vaadin:flow-server (Maven) Vendor— Affected 1.1.0 to before 2.4.7 Fixed in 2.4.7 Patch available GHSA-xwg3-qrcg-w9x6
- com.vaadin:flow-server (Maven) Vendor— Affected 3.0.0 to before 5.0.3 Fixed in 5.0.3 Patch available GHSA-xwg3-qrcg-w9x6
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* | 1.0.0 to before 1.0.14; 1.1.0 to before 2.0.0; 2.0.0 to before 2.4.7; 3.0.0 to before 5.0.0; 5.0.0 to before 5.0.3 | Vulnerable | Vaadin |
| cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* | 10.0.0 to before 10.0.17; 11.0.0 to before 14.0.0; 14.0.0 to before 14.4.7; 15.0.0 to before 17.0.0; 18.0.0 to before 18.0.6 | Vulnerable | Vaadin |
- cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.14; 1.1.0 to before 2.0.0; 2.0.0 to before 2.4.7; 3.0.0 to before 5.0.0; 5.0.0 to before 5.0.3 Vulnerable ·Vaadin
- cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.17; 11.0.0 to before 14.0.0; 14.0.0 to before 14.4.7; 15.0.0 to before 17.0.0; 18.0.0 to before 18.0.6 Vulnerable ·Vaadin
Remediation
- Fix · GHSA-xwg3-qrcg-w9x6 com.vaadin:flow-server (Maven) Fixed in 1.0.14 Advisory →
- Fix · GHSA-xwg3-qrcg-w9x6 com.vaadin:flow-server (Maven) Fixed in 2.4.7 Advisory →
- Fix · GHSA-xwg3-qrcg-w9x6 com.vaadin:flow-server (Maven) Fixed in 5.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31404
- 2026-10-03 Alias added: GHSA-xwg3-qrcg-w9x6
References
More Vaadin Flow vulnerabilities
- TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
- TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
- TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
- TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8
- TI-2021-11540 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.1
- TI-2020-18602 Potential sensitive data exposure in applications using Vaadin 15 CVSS 3.1MEDIUM 6.5
Sources
- CVE-2021-31404 · CVE Program
- CVE-2021-31404 · NVD
- FIRST EPSS
- GHSA-xwg3-qrcg-w9x6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences