GHSA-crh4-294p-vcfq Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Attackers can cause denial of service in Vaadin applications by submitting malicious email addresses to the EmailField component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-crh4-294p-vcfq?
GHSA-crh4-294p-vcfq is a denial of service vulnerability in com.vaadin:vaadin-text-field-flow, published on 19 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Which versions are affected by GHSA-crh4-294p-vcfq?
4 open source packages ship an affected version, including com.vaadin:vaadin-text-field-flow.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:vaadin-text-field-flow Maven | From 2.0.4 | 2.3.3 |
com.vaadin:vaadin-text-field-flow Maven | From 2.0.4 | 2.3.3 |
com.vaadin:vaadin-text-field-flow Maven | From 3.0.0 | 4.0.3 |
com.vaadin:vaadin-text-field-flow Maven | From 3.0.0 | 4.0.3 |
How do I fix GHSA-crh4-294p-vcfq?
Upgrade com.vaadin:vaadin-text-field-flow to a fixed version for your release line: 2.3.3 or 4.0.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-crh4-294p-vcfq being exploited?
There is no known exploitation of GHSA-crh4-294p-vcfq in the wild and no public exploit code.