CVE-2021-31403: Timing side channel vulnerability in Vaadin 7 and 8
Summary
CVE-2021-31403: Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8. Affects com.vaadin:vaadin-bom across 2 version ranges.
>= 7.0.0, < 7.7.24
>= 8.0.0, < 8.12.3
Fixed in 7.7.24 or 8.12.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. It provides a set of user interface components and tools for creating responsive and interactive web interfaces. The Vaadin framework includes several modules, including the vaadin-server module, which handles server-side processing and communication with the client-side UI.
This vulnerability affects versions 7.0.0 through 7.7.23 (Vaadin 7) and 8.0.0 through 8.12.2 (Vaadin 8) of the com.vaadin:vaadin-server package. The vulnerability arises from a non-constant-time comparison of CSRF tokens in the UIDL (UI Description Language) request handler. An attacker can exploit this vulnerability to guess a security token via a timing attack.
Vulnerability Detail
The vulnerability in the UIDL request handler of Vaadin 7 and 8 arises from a non-constant-time comparison of CSRF tokens. This means that the comparison operation takes different amounts of time depending on the input, allowing an attacker to guess the security token via a timing attack.
By carefully measuring the time it takes for the comparison operation to complete, an attacker can infer information about the CSRF token and potentially bypass the security measures in place.
This vulnerability has a CVSS score of 4.0, indicating a moderate severity level.
How To Fix
Latest published version: 25.3.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.7.247.7.24 -
>= 8.0.0, < 8.12.38.12.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to a fixed version of the com.vaadin:vaadin-server package and implement proper CSRF protection measures.
Conclusion
The timing side channel vulnerability in Vaadin 7 and 8 can allow an attacker to guess a security token via a timing attack. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of the com.vaadin:vaadin-server package and implement proper CSRF protection measures. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
Vaadin is an open-source Java framework for building web applications with a rich user interface.
The com.vaadin:vaadin-server package is a module of the Vaadin framework that handles server-side processing and communication with the client-side UI.
A timing attack is a type of side-channel attack where an attacker measures the time it takes for certain operations to complete in order to gain information about sensitive data.
A CSRF token is a security measure used to protect against cross-site request forgery (CSRF) attacks. It is a unique token generated for each user session and included in requests to verify the authenticity of the request.
The CVSS score of this vulnerability is 4.0, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
