medium4.3
CVE-2021-33609
Denial of service in DataCommunicator class in Vaadin 8
Impact
Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.vaadin:vaadin-server | >= 8.0.6, < 8.14.1 | 8.14.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vaadin | Vaadin | from 8.0.0 before 8.14.1 |