What’s Vulnerable › Vulnerabilities

CVE-2021-31407: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-04-23 · updated 2026-06-17
• Weakness: CWE-402

Description

Vulnerability in OSGi integration in com.vaadin:flow-server versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

Affected products

• vaadin flow: from 1.2.0 before 2.4.8; from 6.0.0 before 6.0.2 — fixed in 2.4.8, 6.0.2
• Vaadin: from 12.0.0 before 14.4.10; 19.0.0 — fixed in 14.4.10

How to fix

Upgrade to a fixed version: vaadin flow 2.4.8, 6.0.2; Vaadin 14.4.10. Check the vendor advisory for mitigations.

References

• https://github.com/vaadin/flow/pull/10229
• https://github.com/vaadin/flow/pull/10269
• https://github.com/vaadin/osgi/issues/50
• https://vaadin.com/security/cve-2021-31407
• https://github.com/vaadin/flow/pull/10229
• https://github.com/vaadin/flow/pull/10269
• https://github.com/vaadin/osgi/issues/50
• https://vaadin.com/security/cve-2021-31407

Get alerted when CVE-2021-31407 or the next vulnerability affects your stack