Key points
- Vaadin Framework versions 8.16.0 through 8.32.1 are vulnerable to CVE-2026-110803.
- The flaw has a CVSS score of 8.7, rated as high severity by the National Vulnerability Database.
- Vaadin has released version 8.32.2 to resolve the issue.
Vaadin Framework versions 8.16.0 through 8.32.1 contain a flaw that allows attackers to crash applications. The vendor has released version 8.32.2 to fix the problem. Systems running older versions need to update immediately to prevent service disruption. This issue affects web applications built with the Vaadin platform.
In plain English
The vulnerability exists in how the software handles user sessions. When a request arrives, the system locks the session to ensure data safety. It then checks a specific parameter called v-uiId. If this parameter contains non-numeric text, the system tries to convert it to a number. This conversion fails and triggers an error. The error occurs while the session lock is still held. The lock is never released afterward.
The background
Because the lock remains active, the server thread stays occupied. It cannot process new requests for that specific session. Every subsequent request to the same session waits forever for the lock. An attacker can send many such requests. This quickly exhausts the server's thread pool. Once all threads are blocked, the application stops responding. No authentication is required to exploit this flaw. Attackers only need a session cookie, which any client can obtain with a single request. Vaadin Framework 7 and Vaadin 10 and later are not affected.
What changes now
Vaadin has issued version 8.32.2 for the affected range. This release corrects the locking behavior. Users of Vaadin Framework 8.16.0 through 8.32.1 should upgrade. The fix applies to the vaadin-server and vaadin-server-mpr-jakarta components. Maven coordinates for these components should be updated to version 8.32.2 or higher. Vaadin 7 and Vaadin 10 do not require updates for this specific issue.
Who needs to act first
Teams usually prioritize systems exposed to the public internet. Check which applications use Vaadin Framework 8. Back up current configurations before applying changes. Test the update in a staging environment first. Verify that sessions behave correctly after the upgrade. Monitor server logs for unusual thread usage. Ensure that deployment processes include the new library versions. Communicate maintenance windows to users if downtime is expected.
What to do and how to stay safe: Vaadin
- Identify all applications using Vaadin Framework 8.16.0 through 8.32.1.
- Update dependencies to Vaadin Framework 8.32.2 or later.
- Monitor server thread pools for signs of exhaustion.
- Review access logs for suspicious request patterns.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Vaadin versions are vulnerable?
Vaadin Framework versions 8.16.0 through 8.32.1 are affected by this flaw.
Is authentication required to exploit this?
No, an attacker only needs a session cookie to trigger the denial of service.
Does Vaadin 10 have this issue?
No, Vaadin 10 and later are not affected by this specific vulnerability.
