GMS-2021-70: Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

October 13, 2021

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

References

github.com/advisories/GHSA-jfmf-w293-8xr8
github.com/vaadin/framework/security/advisories/GHSA-jfmf-w293-8xr8
vaadin.com/security/cve-2021-31409

Detect and mitigate GMS-2021-70 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →