GHSA-j23j-q57m-63v3
Denial of service in DataCommunicator class in Vaadin 8
GHSA-j23j-q57m-63v3 is a medium vulnerability (CVSS 4.3) in com.vaadin:vaadin-server, published October 13, 2021. No source lists public exploit code. Fixed in com.vaadin:vaadin-server 8.14.1.
- Severity
- 4.3 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.14.1com.vaadin:vaadin-server +1 more
Description
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.vaadin:vaadin-serverMaven | 8.0.0 up to 8.14.1 | 8.14.1 |
com.vaadin:vaadin-serverMaven | 8.0.0 up to 8.14.1, plus listed versions 8.0.18.0.28.0.38.0.48.0.5 Show 45 moreShow less8.0.68.0.78.1.08.1.18.1.28.1.38.1.48.1.58.1.68.1.78.1.88.10.08.10.18.10.28.10.38.10.48.10.58.11.08.11.18.11.28.11.38.12.08.12.18.12.28.12.38.12.48.13.08.13.18.13.28.13.38.14.08.2.08.2.18.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.4.48.4.58.5.08.5.1 | 8.14.1 |
What each source reports
GitHub Advisories Score used
Denial of service in DataCommunicator class in Vaadin 8
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
- Record
GHSA-j23j-q57m-63v3- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Denial of service in DataCommunicator class in Vaadin 8
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
- Record
GHSA-j23j-q57m-63v3- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 22 versions. The JSON record has them.