Timing Side Channel Vulnerability in Vaadin
Summary
GHSA-c6c4-7x48-4cqp: Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18. Affects com.vaadin:vaadin-bom across 3 version ranges.
>= 10.0.0, < 10.0.17
>= 11.0.0, < 14.4.7
>= 15.0.0, < 18.0.6
Fixed in 10.0.17, 14.4.7 or 18.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. It provides a set of user interface components and tools for creating responsive and interactive web interfaces. The Vaadin framework is widely adopted and used in various applications across different industries. However, a timing side channel vulnerability has been identified in the UIDL request handler of Vaadin versions 10 to 18. This vulnerability can be exploited by an attacker to guess a security token through a timing attack.
Vulnerability Detail
The vulnerability arises from a non-constant-time comparison of CSRF tokens in the UIDL request handler of Vaadin. This insecure comparison allows an attacker to exploit timing differences and guess the security token. By leveraging this vulnerability, an attacker could potentially bypass CSRF protection mechanisms and perform unauthorized actions on behalf of a user. The impact of this vulnerability can vary depending on the specific application and the actions that can be performed with the compromised security token.
How To Fix
Latest published version: 25.3.3 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.0.1710.0.17 -
>= 11.0.0, < 14.4.714.4.7 -
>= 15.0.0, < 18.0.618.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, developers can implement their own constant-time comparison function for CSRF tokens in the UIDL request handler. This can be achieved by using a secure comparison algorithm, such as the one provided by the MessageDigest.isEqual() method in Java. By ensuring that the comparison operation takes a constant amount of time, the timing side channel vulnerability can be mitigated.
Conclusion
The timing side channel vulnerability in Vaadin's UIDL request handler can potentially allow an attacker to guess a security token and bypass CSRF protection mechanisms. It is crucial for developers using Vaadin to upgrade to the fixed versions and ensure their applications are not vulnerable to this exploit. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
Vaadin is an open-source Java framework for building web applications with a set of user interface components and tools.
A timing side channel vulnerability is a type of security flaw that arises from variations in the time taken to perform certain operations. By measuring these timing differences, an attacker can gain information about sensitive data or cryptographic keys.
An attacker can exploit this vulnerability by leveraging timing differences in the UIDL request handler to guess a security token. This can potentially allow the attacker to bypass CSRF protection mechanisms and perform unauthorized actions on behalf of a user.
A CSRF token is a security measure used to protect against Cross-Site Request Forgery (CSRF) attacks. It is a unique token generated for each user session and included in requests to verify the authenticity of the request.
To fix this vulnerability, you should upgrade your Vaadin version to the fixed version mentioned in the 'how_to_fix' section. Update your project's dependencies to use the fixed versions of the com.vaadin:vaadin-bom package.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
