CVE-2021-33609CWE-400

Denial of service in DataCommunicator class in Vaadin 8

Medium · published October 13, 2021

CVSS v3.1
4.3
EPSS
1%
Percentile
60.7
In the wild
Unconfirmed
What it is

Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00945 · 60.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-10-13T10:58Z
EPSS history
Timeline
  • 13 OCT 10:58Z
    Denial of service in DataCommunicator class in Vaadin 8
    cvelistv5