CVE-2026-110803 (GCVE-0-2026-110803)

Vulnerability from cvelistv5 – Published: 2026-10-21 18:22 – Updated: 2026-10-21 18:22
VLAI
Title
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
Summary
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin Framework 8.16.0 - 8.32.1 Mitigation Upgrade to 8.32.2 Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CWE
  • CWE-667 - Improper Locking
  • CWE-400 - Uncontrolled Resource Consumption
Assigner
Vaadin CNA under the mitre root
CNA scorecard – unranked: 6 records in the last 180 days, 10 needed details
References
Impacted products
Vendor Product Version CPE status
vaadin framework Affected: 8.16.0 , < 8.32.2 (maven)
guessed Create a notification for this product.
vaadin framework Affected: 8.18.0 , < 8.32.2 (maven)
guessed Create a notification for this product.
Credits
Michal Legocki, Finago
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:vaadin-server",
          "product": "framework",
          "repo": "https://github.com/vaadin/framework",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "8.32.2",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.vaadin:vaadin-server-mpr-jakarta",
          "product": "framework",
          "repo": "https://github.com/vaadin/framework",
          "vendor": "vaadin",
          "versions": [
            {
              "lessThan": "8.32.2",
              "status": "affected",
              "version": "8.18.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Michal Legocki, Finago"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgba(232, 232, 232, 0.04);\"\u003eVaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003eUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\u003cbr\u003e\u003cbr\u003eProduct version\u003cbr\u003eVaadin Framework 8.16.0 - 8.32.1\u003cbr\u003e\u003cbr\u003eMitigation\u003cbr\u003eUpgrade to 8.32.2\u003cbr\u003e\u003cbr\u003eVaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.\u003cbr\u003e\u003cbr\u003eArtifacts\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003eMaven coordinates\u003c/td\u003e\u003ctd\u003eVulnerable versions\u003c/td\u003e\u003ctd\u003eFixed version\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-server\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e8.16.0 - 8.32.1\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;8.32.2\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003ecom.vaadin:vaadin-server-mpr-jakarta\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e8.18.0 - 8.32.1\u003cbr\u003e\u003c/td\u003e\u003ctd\u003e\u0026ge;8.32.2\u003cbr\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/span\u003e"
            }
          ],
          "value": "VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin Framework 8.16.0 - 8.32.1\n\nMitigation\nUpgrade to 8.32.2\n\nVaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin-server / 8.16.0 - 8.32.1 / \u003e=8.32.2\ncom.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / \u003e=8.32.2"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-25",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-25 Forced Deadlock"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "USER",
            "Safety": "NEGLIGIBLE",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667 Improper Locking",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-400",
              "description": "CWE-400 Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T18:22:59.789Z",
        "orgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e",
        "shortName": "Vaadin"
      },
      "references": [
        {
          "url": "https://vaadin.com/security/cve-2026-110803"
        },
        {
          "url": "https://github.com/vaadin/framework/releases/tag/8.32.2"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cspan style=\"background-color: transparent;\"\u003eUsers of affected versions should apply the following mitigation or upgrade.\u003c/span\u003e\u003c/b\u003e\u003cbr\u003e"
            }
          ],
          "value": "Users of affected versions should apply the following mitigation or upgrade."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8",
      "workarounds": [
        {
          "lang": "en",
          "value": "Reject requests whose v-uiId parameter is not an integer before Vaadin handles them, by overriding VaadinServlet.service() and answering 400 for those requests. Locks that have already leaked are only released by restarting the application."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9e0f3122-90e9-42d5-93de-8c6b98deef7e",
    "assignerShortName": "Vaadin",
    "cveId": "CVE-2026-110803",
    "datePublished": "2026-10-21T18:22:59.789Z",
    "dateReserved": "2026-10-14T17:48:34.531Z",
    "dateUpdated": "2026-10-21T18:22:59.789Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-110803",
      "date": "2026-10-23",
      "epss": "0.00279",
      "percentile": "0.19258"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "com.vaadin:vaadin-server",
                "product": "framework",
                "repo": "https://github.com/vaadin/framework",
                "vendor": "vaadin",
                "versions": [
                  {
                    "lessThan": "8.32.2",
                    "status": "affected",
                    "version": "8.16.0",
                    "versionType": "maven"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "com.vaadin:vaadin-server-mpr-jakarta",
                "product": "framework",
                "repo": "https://github.com/vaadin/framework",
                "vendor": "vaadin",
                "versions": [
                  {
                    "lessThan": "8.32.2",
                    "status": "affected",
                    "version": "8.18.0",
                    "versionType": "maven"
                  }
                ]
              }
            ],
            "source": "security@vaadin.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either.\n\n\nUsers of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include:\n\nProduct version\nVaadin Framework 8.16.0 - 8.32.1\n\nMitigation\nUpgrade to 8.32.2\n\nVaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue.\n\nArtifacts\nMaven coordinates / Vulnerable versions / Fixed version\ncom.vaadin:vaadin-server / 8.16.0 - 8.32.1 / \u003e=8.32.2\ncom.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / \u003e=8.32.2"
          }
        ],
        "id": "CVE-2026-110803",
        "lastModified": "2026-10-22T15:37:23.163",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@vaadin.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-21T19:16:58.567",
        "references": [
          {
            "source": "security@vaadin.com",
            "url": "https://github.com/vaadin/framework/releases/tag/8.32.2"
          },
          {
            "source": "security@vaadin.com",
            "url": "https://vaadin.com/security/cve-2026-110803"
          }
        ],
        "sourceIdentifier": "security@vaadin.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-400"
              },
              {
                "lang": "en",
                "value": "CWE-667"
              }
            ],
            "source": "security@vaadin.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.