GHSA-crh4-294p-vcfq
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
- Record
GHSA-crh4-294p-vcfq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
- Record
GHSA-crh4-294p-vcfq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadin-text-field-flowMaven | 2.0.4 up to 2.3.3 | 2.3.3 |
com.vaadin:vaadin-text-field-flowMaven | 3.0.0 up to 4.0.3 | 4.0.3 |
com.vaadin:vaadin-text-field-flowMaven | 2.0.4 up to 2.3.3, plus listed versions 2.0.52.0.62.0.72.0.82.1.0 Show 7 moreShow less2.1.12.1.22.2.02.2.12.3.02.3.12.3.2 | 2.3.3 |
com.vaadin:vaadin-text-field-flowMaven | 3.0.0 up to 4.0.3, plus listed versions 3.0.13.1.03.1.13.1.24.0.04.0.14.0.2 | 4.0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-crh4-294p-vcfq is a high vulnerability (CVSS 7.5) in com.vaadin:vaadin-text-field-flow, published April 19, 2021. No source lists public exploit code. Fixed in com.vaadin:vaadin-text-field-flow 2.3.3.