TI-2021-12989 Aliases CVE-2021-33609 GHSA-qcgx-crrx-38v5

Denial of service in DataCommunicator class in Vaadin 8

LOW 22CWE-400Published 2021-10-13 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

Why it matters now

EPSS 0.00945 61st percentileScored 2026-11-07

Fix Fixed com.vaadin:vaadin-server (Maven): 8.14.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Vaadin	Vaadin	8.0.0 and later; up to 8.14.0	—	No fix listed	CNA
Vaadin	vaadin-server	8.0.0 and later; up to 8.14.0	—	No fix listed	CNA
—	com.vaadin:vaadin-server (Maven)	8.0.6 to before 8.14.1	8.14.1	Patch available	GHSA-qcgx-crrx-38v5

Vaadin VendorVaadin Affected 8.0.0 and later; up to 8.14.0 Fixed in — No fix listed CNA
vaadin-server VendorVaadin Affected 8.0.0 and later; up to 8.14.0 Fixed in — No fix listed CNA
com.vaadin:vaadin-server (Maven) Vendor— Affected 8.0.6 to before 8.14.1 Fixed in 8.14.1 Patch available GHSA-qcgx-crrx-38v5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vaadin:vaadin::::::::	8.0.0 to before 8.14.1	Vulnerable	Vaadin

cpe:2.3:a:vaadin:vaadin:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.14.1 Vulnerable ·Vaadin

Remediation

Fix · GHSA-qcgx-crrx-38v5 com.vaadin:vaadin-server (Maven) Fixed in 8.14.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-33609
2026-10-03 Alias added: GHSA-qcgx-crrx-38v5

References

Patch 1

https://github.com/vaadin/framework/pull/12415

Advisory 2

Other 2

TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
TI-2022-12014 Possible information disclosure inside TreeGrid component with default data provider CVSS 3.1HIGH 7.5
TI-2021-11537 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5
TI-2020-18604 Directory traversal in development mode handler in Vaadin 14 and 15-17 CVSS 3.1HIGH 7.5

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences