Route Enumeration Vulnerability in Vaadin Flow Server
Summary
GHSA-fr26-qjc8-mvjx: Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1... Affects com.vaadin:flow-server across 3 version ranges.
>= 1.0.0, < 1.0.15
>= 1.1.0, < 2.6.2
>= 3.0.0, < 6.0.10
Fixed in 1.0.15, 2.6.2 or 6.0.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin Flow Server is an open-source framework for building web applications in Java. It provides a set of tools and components to simplify the development process. The vulnerability affects versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8).
Vulnerability Detail
The vulnerability arises from improper sanitization of the path in the default RouteNotFoundError view in Vaadin Flow Server. When the application is running in production mode and no custom handler for NotFoundException is provided, a network attacker can enumerate all available routes by sending a crafted HTTP request. This can lead to potential route enumeration and information disclosure.
How To Fix
Latest published version: 25.3.4 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.151.0.15 -
>= 1.1.0, < 2.6.22.6.2 -
>= 3.0.0, < 6.0.106.0.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, a workaround is to provide a custom handler for NotFoundException that returns a generic error message instead of the default RouteNotFoundError view. This can help prevent route enumeration by obscuring the specific error response.
Conclusion
The route enumeration vulnerability in Vaadin Flow Server can be mitigated by upgrading to the fixed versions or implementing the provided workaround. It is important to take action to prevent potential information disclosure and route enumeration. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:flow-server →
FAQ
Vaadin Flow Server is an open-source framework for building web applications in Java. It provides a set of tools and components to simplify the development process.
The vulnerability affects versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8).
The vulnerability allows a network attacker to enumerate all available routes in the application, potentially leading to information disclosure and route enumeration.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of Vaadin Flow Server. For versions 1.0.0 through 1.0.14, upgrade to version 1.0.15. For versions 1.1.0 through 2.6.1, upgrade to version 2.6.2. For versions 3.0.0 through 6.0.9, upgrade to version 6.0.10.
Yes, a workaround is to provide a custom handler for NotFoundException that returns a generic error message instead of the default RouteNotFoundError view. This can help prevent route enumeration by obscuring the specific error response.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:flow-server.
