GHSA-qcgx-crrx-38v5

Denial of service in DataCommunicator class in Vaadin 8

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-33609

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.vaadin:vaadin-server	>= 8.0.6, < 8.14.1	8.14.1

Details

As written in the advisory (Markdown source, shown as plain text).

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

References

External links from the advisory. They lead to third-party sites.

https://github.com/vaadin/framework/security/advisories/GHSA-qcgx-crrx-38v5 web
https://nvd.nist.gov/vuln/detail/CVE-2021-33609 advisory
https://github.com/vaadin/framework/pull/12415 web
https://github.com/vaadin/framework package
https://vaadin.com/security/cve-2021-33609 web