TI-2021-11541 Aliases CVE-2021-31409 GHSA-c332-w4jm-55wv

Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19

LOW 36CWE-400Published 2021-05-05 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Why it matters now

EPSS 0.01672 76th percentileScored 2026-11-07

Fix Fixed com.vaadin:vaadin-compatibility-server (Maven): 8.13.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Vaadin	Vaadin	8.0.0 and later	—	No fix listed	CNA
Vaadin	vaadin-compatibility-server	8.0.0 and later	—	No fix listed	CNA
—	com.vaadin:vaadin-compatibility-server (Maven)	8.0.0 to before 8.13.0	8.13.0	Patch available	GHSA-c332-w4jm-55wv

Vaadin VendorVaadin Affected 8.0.0 and later Fixed in — No fix listed CNA
vaadin-compatibility-server VendorVaadin Affected 8.0.0 and later Fixed in — No fix listed CNA
com.vaadin:vaadin-compatibility-server (Maven) Vendor— Affected 8.0.0 to before 8.13.0 Fixed in 8.13.0 Patch available GHSA-c332-w4jm-55wv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vaadin:vaadin::::::::	8.0.0 – 8.12.4	Vulnerable	Vaadin

cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.12.4 Vulnerable ·Vaadin

Remediation

Fix · GHSA-c332-w4jm-55wv com.vaadin:vaadin-compatibility-server (Maven) Fixed in 8.13.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-31409
2026-10-03 Alias added: GHSA-c332-w4jm-55wv

References

Patch 2

Advisory 2

Other 1

https://github.com/vaadin/framework/security/advisories/GHSA-c332-w4jm-55wv

TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2021-11543 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19 CVSS 3.1HIGH 7.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences