GHSA-2wqp-jmcc-mc77

Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17

Source: GitHub Advisory Database (reviewed) High CVE-2021-31405

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.vaadin:vaadin-bom	>= 14.0.6, < 14.4.4	14.4.4
Maven	com.vaadin:vaadin-bom	>= 15.0.0, < 17.0.11	17.0.11

Details

As written in the advisory (Markdown source, shown as plain text).

Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses. - https://vaadin.com/security/cve-2021-31405

References

External links from the advisory. They lead to third-party sites.

https://github.com/vaadin/platform/security/advisories/GHSA-2wqp-jmcc-mc77 web
https://nvd.nist.gov/vuln/detail/CVE-2021-31405 advisory
https://github.com/vaadin/flow-components/pull/442 web
https://vaadin.com/security/cve-2021-31405 web