CVE-2021-33609

Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

Score

CVSS 3.1 4.3 Medium

Status

Modified - security@vaadin.com

Published

2021-10-13

Last modified

2024-09-16

Weaknesses

CWE-20, CWE-400

Affected products

• Vaadin (Vaadin)
• Vaadin-server (Vaadin)

References

• https://github.com/vaadin/framework/pull/12415
• https://vaadin.com/security/cve-2021-33609