GitHub Advisoryadvisory · Maven

GHSA-jfmf-w293-8xr8 Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

HIGH Published 2021-10-13 Modified 2021-10-13 Official page ↗

Ecosystem: Maven
Packages: com.vaadin:vaadin-bom
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Reviewed: 2021-10-13

Affected packages

• Maven com.vaadin:vaadin-bom: >= 8.0.0, < 8.13.0 → fixed in 8.13.0

Description

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

References

https://github.com/vaadin/framework/security/advisories/GHSA-jfmf-w293-8xr8 web
https://github.com/vaadin/framework package
https://vaadin.com/security/cve-2021-31409 web