GHSA-c332-w4jm-55wv

ghsaUSosv

Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

view advisory published 2021-05-04Licence: CC-BY-4.0

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-31409US	high7.5	1.67% (77th)	—	2021-05-06
Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers…

references

External citations — patches, advisories, analysis.

https://github.com/vaadin/framework/issues/12240WEB
https://github.com/vaadin/framework/pull/12241WEB
https://github.com/vaadin/framework/security/advisories/GHSA-c332-w4jm-55wvWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-31409ADVISORY
https://vaadin.com/security/cve-2021-31409WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan