CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-31405
High (7.5) in vaadin. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in com.vaadin:vaadin-bom 14.4.4, 17.0.11.
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vaadin:flow
- vaadin:vaadin
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2wqp-jmcc-mc77 | Maven | com.vaadin:vaadin-bom | >=14.0.6 <14.4.4 | 14.4.4 |
| GHSA-2wqp-jmcc-mc77 | Maven | com.vaadin:vaadin-bom | >=15.0.0 <17.0.11 | 17.0.11 |