Read the docs
TI-2026-78950 Aliases CVE-2026-110803

Session lock leak in Vaadin Framework 8 allows denial of service

Priority MEDIUM 43CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Vaadin Framework 8 from 8.16.0 before 8.32.2 (vaadin-server, including the vaadin-server-mpr-jakarta package from 8.18.0) leaks a session lock when a request carries a non-numeric v-uiId parameter. The parameter is read outside the block that releases the lock, so the lock stays held by the container thread after parsing fails. An unauthenticated remote attacker can obtain a session cookie with one request and repeat the invalid request, which blocks later requests to that session and exhausts the thread pool (CWE-667). Vaadin 7 and Vaadin 10 and later are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin Framework 8.16.0 - 8.32.1 Mitigation Upgrade to 8.32.2 Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed framework (vaadin): 8.32.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Vaadinframework8.16.0 to before 8.32.28.32.2Patch availableCNA
Vaadinframework8.18.0 to before 8.32.28.32.2Patch availableCNA
  • framework VendorVaadin Affected 8.16.0 to before 8.32.2 Fixed in 8.32.2 Patch available CNA
  • framework VendorVaadin Affected 8.18.0 to before 8.32.2 Fixed in 8.32.2 Patch available CNA

Remediation

Upgrade Vaadin Framework 8 to 8.32.2 or later. Vaadin 7 and Vaadin 10 and later need no upgrade for this issue because they are not affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA framework (vaadin) Fixed in 8.32.2
  • Fix · CNA framework (vaadin) Fixed in 8.32.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-110803
  2. 2026-10-23 Priority changed: MEDIUM → LOW
  3. 2026-10-30 CISA SSVC decision points changed
  4. 2026-10-30 Priority changed: LOW → MEDIUM
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Other 2

  • TI-2026-81073 Vaadin push endpoint reflects any Origin and allows credentials CVSS 4.0LOW 2.3
  • TI-2021-11539 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19 CVSS 3.1HIGH 8.6
  • TI-2021-11542 Project sources exposure in Vaadin Designer CVSS 3.1HIGH 8.6
  • TI-2026-78949 Multiple flaws in Highcharts bundled with Vaadin Charts CVSS 4.0HIGH 8.4
  • TI-2020-18603 Regular expression Denial of Service (ReDoS) in EmailValidator class in Vaadin 7 CVSS 3.1HIGH 7.5
  • TI-2021-11541 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19 CVSS 3.1HIGH 7.5
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences