Read the docs
TI-2021-11537 Aliases CVE-2021-31405GHSA-2wqp-jmcc-mc77

Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17

Priority LOW 35CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Why it matters now

EPSS 0.01127 66th percentileScored 2026-11-07
Fix Fixed com.vaadin:vaadin-bom (Maven): 14.4.4, 17.0.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
VaadinVaadin14.0.6 and later—No fix listedCNA
Vaadinvaadin-text-field-flow2.0.4 and later—No fix listedCNA
—com.vaadin:vaadin-bom (Maven)14.0.6 to before 14.4.414.4.4Patch availableGHSA-2wqp-jmcc-mc77
—com.vaadin:vaadin-bom (Maven)15.0.0 to before 17.0.1117.0.11Patch availableGHSA-2wqp-jmcc-mc77
  • Vaadin VendorVaadin Affected 14.0.6 and later Fixed in — No fix listed CNA
  • vaadin-text-field-flow VendorVaadin Affected 2.0.4 and later Fixed in — No fix listed CNA
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 14.0.6 to before 14.4.4 Fixed in 14.4.4 Patch available GHSA-2wqp-jmcc-mc77
  • com.vaadin:vaadin-bom (Maven) Vendor— Affected 15.0.0 to before 17.0.11 Fixed in 17.0.11 Patch available GHSA-2wqp-jmcc-mc77

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:*2.0.4 to before 2.3.3; 3.0.0 to before 4.0.3VulnerableVaadin
cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:*14.0.6 to before 14.4.4; 15.0.0 to before 17.0.11VulnerableVaadin
  • cpe:2.3:a:vaadin:flow:*:*:*:*:*:*:*:* Versions 2.0.4 to before 2.3.3; 3.0.0 to before 4.0.3 Vulnerable ·Vaadin
  • cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 14.0.6 to before 14.4.4; 15.0.0 to before 17.0.11 Vulnerable ·Vaadin

Remediation

  • Fix · GHSA-2wqp-jmcc-mc77 com.vaadin:vaadin-bom (Maven) Fixed in 14.4.4 Advisory →
  • Fix · GHSA-2wqp-jmcc-mc77 com.vaadin:vaadin-bom (Maven) Fixed in 17.0.11 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-31405
  2. 2026-10-03 Alias added: GHSA-2wqp-jmcc-mc77

References

Patch 1

Advisory 2

Other 1

  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
  • TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8
  • TI-2021-11540 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.1
  • TI-2020-18602 Potential sensitive data exposure in applications using Vaadin 15 CVSS 3.1MEDIUM 6.5
  • TI-2019-15167 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13 CVSS 3.1MEDIUM 6.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences