Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

Permissive Cross-domain Policy with Untrusted Domains

Overview com.vaadin:vaadin-server is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response heade...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server (>=8.0.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755468...

com.vaadin:mpr-v7 (>=7.0.0, <=8.0.1), com.vaadin:vaadin-cdi (1.9.0) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=7.7.37, <=7.7.54)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =7.7.37, =7.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.0 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755469...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +150 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server (>=7.1.0, <=7.7.54)

com.vaadin:vaadin-server MAVEN version =7.1.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755468...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +150 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server (>=7.1.0, <=7.7.54)

com.vaadin:vaadin-server MAVEN version =7.1.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2026-110737 Source advisory: MEND:CVE-2026-110737...

com.vaadin:mpr-v7 (>=7.0.0, <=8.0.1), com.vaadin:vaadin-cdi (1.9.0) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=7.7.37, <=7.7.54)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =7.7.37, =7.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.0 Source cves: CVE-2026-110737 Source advisory: MEND:CVE-2026-110737...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server (>=8.0.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2026-110737 Source advisory: MEND:CVE-2026-110737...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking due to the improper release of a session lock in the VaadinService.requestEnd process when handling a non-numeric v-uiId request parameter. An attacker can cause the application to become unresponsive by sending request...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

com.github.mvysny.kaributesting:karibu-testing-v8 (>=1.3.17, <=1.4.5), com.vaadin:mpr-core (>=7.0.0, <=7.0.11) +18 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server (>=8.16.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.16.0, =1.3.17, =7.0.0, =6.0.3, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.18.0, =8.32.1 and more Source cves: CVE-2026-110803 Source advisory: SNYK:JAVA-COMVAADIN-21691526...

Improper Locking

Overview com.vaadin:vaadin-server is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Improper Locking due to the improper release of a session lock in the VaadinService.requestEnd process when handling a non-numeric v-uiId request parameter. ...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-110803

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-110803

The Vaadin Framework 8 (specifically com.vaadin:vaadin-server versions 8.16.0 - 8.32.1 and com.vaadin:vaadin-server-mpr-jakarta versions 8.18.0 - 8.32.1 ) is vulnerable to a session lock leak leading to a Denial of Service (DoS) . The root cause is in VaadinService.requestEnd(), where the applica...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

EUVD-2026-107492

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...