CVE-2026-110803: CWE-667 Improper Locking in vaadin framework

In Vaadin Framework 8, specifically versions 8.16.0 through 8.32.1, the VaadinService.requestEnd() method improperly handles session locking. It locks the session and then reads the v-uiId request parameter outside the lock release block. If the v-uiId parameter is non-numeric, Integer.parseInt throws an exception while the session lock is still held. This causes the lock to never be released, resulting in all subsequent requests to that session blocking indefinitely in VaadinService.lockSession(). Repeated exploitation can exhaust the container's thread pool and cause application downtime. No authentication is required beyond possession of a session cookie. Vaadin Framework 7 and Vaadin 10+ are not affected due to different lock handling. The vulnerability is addressed in Vaadin Framework 8.32.2 and later.

An unauthenticated attacker with a valid session cookie can send a specially crafted request with a non-numeric v-uiId parameter that triggers an exception while holding a session lock. This causes the session lock to remain held indefinitely, blocking all subsequent requests to that session. Repeated exploitation can exhaust the server's thread pool, leading to denial of service and application downtime. The vulnerability affects availability but does not require authentication or user interaction beyond obtaining a session cookie.

Upgrade affected Vaadin Framework 8 versions to 8.32.2 or later, where the issue is fixed. Versions 7 and 10 or later are not vulnerable and do not require upgrading for this issue. No other mitigations are specified or required.