com.vaadin:vaadin-server vulnerabilities
CVEs whose affected-version data names the com.vaadin:vaadin-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-110737Low· 2.3Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_OR…
CVE-2026-110803High· 8.7Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the sessi…
CVE-2025-9467Medium· 5.3When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation
When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass the upload validation. Users of affected versions should apply the following mitigation or upgrade. Releases that …