com.vaadin:vaadin-server-mpr-jakarta vulnerabilities

CVEs whose affected-version data names the com.vaadin:vaadin-server-mpr-jakarta package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110803High· 8.7

today

Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the sessi…

▾ Twilightvaadin · com.vaadin:vaadin-servervia CVEORG