CVE-2021-33609: Vaadin

Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days.

Missing check in DataCommunicator class in com.vaadin:vaadin-server versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.

Affected products

• Vaadin Vaadin: from 8.0.0, before 8.14.1 (fixed in 8.14.1)

Published 2021-10-13. Last modified 2026-06-17.