CVE-2026-110803
Description
A flaw was found in Vaadin Framework. An unauthenticated remote attacker can exploit this issue by submitting a specially crafted request containing a non-numeric identifier parameter. This malformed input triggers an unhandled exception before the application can release an internal session lock. Repeated requests leave container threads permanently blocked, exhausting the server thread pool and causing a Denial of Service (DoS).
Statement
Red Hat Product Security rates this vulnerability as having an Important severity impact because unauthenticated remote attackers can trigger complete application denial of service with minimal network traffic. Web services utilizing vulnerable Vaadin Framework runtimes fail to release execution threads when handling malformed UI parameters, allowing an external client to rapidly deplete servlet container worker pools. Applications running on older Vaadin 7 or modern Vaadin 10 and later architectures remain unaffected due to differing session locking mechanisms.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
