com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

com.github.mvysny.kaributesting:karibu-testing-v8 (>=1.3.17, <=1.4.5), com.vaadin:mpr-core (>=7.0.0, <=7.0.11) +18 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server (>=8.16.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.16.0, =1.3.17, =7.0.0, =6.0.3, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.18.0, =8.32.1 and more Source cves: CVE-2026-110803 Source advisory: SNYK:JAVA-COMVAADIN-21691526...

Improper Locking

Overview com.vaadin:vaadin-server is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Improper Locking due to the improper release of a session lock in the VaadinService.requestEnd process when handling a non-numeric v-uiId request parameter. ...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking due to the improper release of a session lock in the VaadinService.requestEnd process when handling a non-numeric v-uiId request parameter. An attacker can cause the application to become unresponsive by sending request...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-110803

The Vaadin Framework 8 (specifically com.vaadin:vaadin-server versions 8.16.0 - 8.32.1 and com.vaadin:vaadin-server-mpr-jakarta versions 8.18.0 - 8.32.1 ) is vulnerable to a session lock leak leading to a Denial of Service (DoS) . The root cause is in VaadinService.requestEnd(), where the applica...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

CVE-2026-110803

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

com.github.mvysny.kaributesting:karibu-testing-v8 (>=1.3.17, <=1.4.5), com.vaadin:mpr-core (>=7.0.0, <=7.0.11) +18 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server (>=8.16.0, <=8.32.1)

com.vaadin:vaadin-server MAVEN version =8.16.0, =1.3.17, =7.0.0, =6.0.3, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.16.0, =8.18.0, =8.32.1 and more Source cves: CVE-2026-110803 Source advisory: MEND:CVE-2026-110803...

EUVD-2026-107492

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

PT-2026-120765

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=8.0.0, <=8.29.0)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=8.0.0, <=8.29.0)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: SNYK:JAVA-COMVAADIN-14860883...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=8.0.0, <=8.29.0)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-15022 Source advisory: MEND:CVE-2025-15022...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: MEND:CVE-2025-15022...

PT-2026-6390

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting XSS if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed version...