Description
Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Vaadin | Vaadin | 8.0.0 – < unspecified, unspecified – ≤ 8.14.0 | unspecified |
| Vaadin | vaadin-server | 8.0.0 – < unspecified, unspecified – ≤ 8.14.0 | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.vaadin:vaadin-server | >= 8.0.6, < 8.14.1 | 8.14.1 | GHSA-qcgx-crrx-38v5 |