Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110803— Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

Quick assessment

Affected
vaadin framework
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Vaadin Framework 8 中， 方法会锁定会话，随后在释放该锁的代码块之外读取 请求参数。如果请求携带非数字格式的 ，则 方法会在会话锁仍被持有期间抛出异常，导致锁永远无法释放。此时，容器线程在仍持有该锁的情况下返回线程池。此后，任何针对该会话的请求都将在 中永久阻塞；若重复发送此类请求，将耗尽线程池，最终导致应用程序不可用。此漏洞无需身份验证即可利用：攻击者仅需通过一次请求获取会话 Cookie，即可发起攻击。 Vaadin 10 及更高版本不受此问题影响，因为 Flow 框架在 块中释放锁，且不

CVSS 8.7 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
vaadin framework 8.16.0< 8.32.2 affected
8.18.0< 8.32.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110803

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8
Source: CVE Program / CVE List V5
Vulnerability Description
VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the container thread returns to its pool still owning it. Every later request to that session then blocks forever in VaadinService.lockSession(), and repeating the request exhausts the thread pool and takes the application down. No authentication is required: a session cookie, which any client obtains with a single request, is enough. Vaadin 10 and later are not affected, because Flow releases the lock in a finally block and does not read that parameter there, and Vaadin Framework 7 is not affected either. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin Framework 8.16.0 - 8.32.1 Mitigation Upgrade to 8.32.2 Vaadin Framework 7 and Vaadin 10 and later do not carry this behaviour and need no upgrade for this issue. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin:vaadin-server / 8.16.0 - 8.32.1 / >=8.32.2 com.vaadin:vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
加锁机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
vaadin framework 8.16.0 ~ 8.32.2 -
vaadin framework 8.18.0 ~ 8.32.2 -

II. Public POCs for CVE-2026-110803

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110803

请登录查看更多情报信息。

Vendor Pages for CVE-2026-110803 (2)

IV. Related Vulnerabilities

Same product: framework
Same vendor: vaadin
Same weakness: CWE-667

V. Comments for CVE-2026-110803

No comments yet

Leave a comment