CVE-2021-31409

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
Vaadin	Vaadin	>= 8.0.0, < *
Vaadin	vaadin-compatibility-server	>= 8.0.0, < *

References

https://github.com/vaadin/framework/issues/12240Patch, Third Party Advisory
https://github.com/vaadin/framework/pull/12241Patch, Third Party Advisory
https://vaadin.com/security/cve-2021-31409Vendor Advisory
https://github.com/vaadin/framework/issues/12240Patch, Third Party Advisory
https://github.com/vaadin/framework/pull/12241Patch, Third Party Advisory
https://vaadin.com/security/cve-2021-31409Vendor Advisory

Timeline

Published: May 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-31417.8In Unisys Stealth (core) before 6.0.025.0, the Keycloak password is stored in a recoverable format that might be accessible by a local attac CVE-2021-314107.5Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access CVE-2021-314117.8Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 thr CVE-2021-314125.3Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 thro CVE-2021-314149.8The unofficial vscode-rpm-spec extension before 0.3.2 for Visual Studio Code allows remote code execution via a crafted workspace configurat CVE-2021-314176.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An CVE-2021-314186.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An CVE-2021-314196.5This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4-47270. An CVE-2021-314208.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.0-48950. An attacker mu CVE-2021-314216.0This vulnerability allows local attackers to delete arbitrary files on affected installations of Parallels Desktop 16.1.1-49141. An attacker CVE-2021-314227.5This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker mu CVE-2021-314236.0This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.5-47309. An