What is GHSA-jfmf-w293-8xr8?

GHSA-jfmf-w293-8xr8 is a security advisory published by GitHub Security Advisories with High severity. Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

Why does GHSA-jfmf-w293-8xr8 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-jfmf-w293-8xr8?

GHSA-jfmf-w293-8xr8 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jfmf-w293-8xr8?

GHSA-jfmf-w293-8xr8 affects 1 product, including: maven/com.vaadin:vaadin-bom:\u003e= 8.0.0, \u003c= 8.12.4.

GHSA-jfmf-w293-8xr8HighCVSS 7.5Disclosed before NVD

Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8

Vendor

GitHub Security Advisories

Published

October 13, 2021

Last Modified

January 9, 2023

📋 Description

Unsafe validation RegEx in EmailValidator component in com.vaadin:vaadin-compatibility-server versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

🎯 Affected products1

maven/com.vaadin:vaadin-bom:>= 8.0.0, <= 8.12.4

🔗 References (3)

https://github.com/vaadin/framework/security/advisories/GHSA-jfmf-w293-8xr8
https://vaadin.com/security/cve-2021-31409
https://github.com/advisories/GHSA-jfmf-w293-8xr8