Session Lock Vulnerability in Vaadin Framework by Vaadin
CVE-2026-110803

8.7HIGH

Key Information:

Vendor

Vaadin

Status
Framework
Vendor
CVE Published:
21 October 2026

What is CVE-2026-110803?

A session lock vulnerability in the Vaadin Framework 8 allows for a denial-of-service condition when a non-numeric v-uiId is processed during a request. The VaadinService.requestEnd() method locks the session before processing this parameter, which can lead to the lock being held indefinitely if an Integer.parseInt error occurs. This results in a scenario where subsequent requests for that session become perpetually blocked, exhausting the application's thread pool and causing a complete application outage. The vulnerability affects a range of versions, prompting users to upgrade to version 8.32.2 or later to mitigate the risks.

Affected Version(s)

framework 8.16.0 < 8.32.2

framework 8.18.0 < 8.32.2

References

https://vaadin.com/security/cve-2026-110803
https://github.com/vaadin/framework/releases/tag/8.32.2

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michal Legocki, Finago
.