CVE-2026-110803

The Vaadin Framework 8 (specifically com.vaadin:vaadin-server versions 8.16.0 - 8.32.1 and com.vaadin:vaadin-server-mpr-jakarta versions 8.18.0 - 8.32.1 ) is vulnerable to a session lock leak leading to a Denial of Service (DoS) . The root cause is in VaadinService.requestEnd(), where the applica...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=8.0.0, <=8.29.0)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-15022 Source advisory: OSV:GHSA-7WWV-79XW-RVVG...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=8.0.0, <=8.29.0)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-15022 Source advisory: GHSA-7WWV-79XW-RVVG...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: SNYK:JAVA-COMVAADIN-14860883...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.49)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-15022 Source advisory: MEND:CVE-2025-15022...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-15022 via com.vaadin:vaadin-server (>=8.0.0, <=8.29.0)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-15022 Source advisory: MEND:CVE-2025-15022...

PT-2026-6390

Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting XSS if caption content is derived from user input. In Vaadin Framework 7 and 8, the Action class is a general-purpose class that may be used by multiple components. The fixed version...

Arbitrary File Upload

com.vaadin:vaadin-server is vulnerable to an Arbitrary File Upload. The vulnerability is due to insufficient validation of metadata in the start listener of incoming uploads, which allows an attacker to bypass upload validation and potentially upload unauthorized or malicious files...

EUVD-2025-26701

Malicious code in bioql PyPI...

CVE-2025-9467

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 7.0.0 -...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.47)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-9467 Source advisory: GHSA-9GFH-4FWJ-W3RJ...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.47)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-9467 Source advisory: SNYK:JAVA-COMVAADIN-12496925...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-server (>=8.0.0, <=8.28.1)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-9467 Source advisory: SNYK:JAVA-COMVAADIN-12496925...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-server (>=8.0.0, <=8.28.1)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-9467 Source advisory: OSV:GHSA-9GFH-4FWJ-W3RJ...

biz.grundner.vaadin-in-spring:spring-vaadin (1.0), ca.qc.ircm:plate-layout (>=0.1, <=0.2) +153 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-server (>=7.0.0, <=7.7.47)

com.vaadin:vaadin-server MAVEN version =7.0.0, =0.1, =1.2.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.1, =1.2 - com.github.transcurity:hexview 1.0.0 and more Source cves: CVE-2025-9467 Source advisory: OSV:GHSA-9GFH-4FWJ-W3RJ...

Arbitrary File Upload

Overview com.vaadin:vaadin-server is a Java framework for modern Java web applications. Affected versions of this package are vulnerable to Arbitrary File Upload via Vaadin Upload's start listener in the multi-upload mode. An attacker can upload unauthorized files by bypassing server-side metadat...

ca.qc.ircm:plate-layout (>=0.8, <=0.9), com.github.elhoce:vaadin-signaturefield-v8 (2.0.9) +142 more potentially affected by CVE-2025-9467 via com.vaadin:vaadin-server (>=8.0.0, <=8.28.1)

com.vaadin:vaadin-server MAVEN version =8.0.0, =0.8, =0.3.1, =1.0.0, =0.3.0, =0.5.1, =0.5.1, =1.0.0, =1.0.9, =1.0.9, =1.7-1, =1.8 and more Source cves: CVE-2025-9467 Source advisory: MEND:CVE-2025-9467...