Is CVE-2026-110803 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110803 being exploited in the wild.

How severe is CVE-2026-110803?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Vaadin Framework 8.16.0 to 8.32.1.

Is there a fix for CVE-2026-110803?

Yes: fixed in 8.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110803 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110803?

Check whether you run Vaadin Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110803: Vaadin Framework 8 session lock denial of service

CVE-2026-110803 · Severity: info · Published 2026-10-21

Vaadin Framework 8 is a Java web application framework. An attacker can supply a malformed request parameter that causes the framework to lock a user session and fail to release it, blocking all subsequent requests from that user and exhausting the application's thread pool. Any attacker without authentication can repeat this attack by obtaining a session cookie from a single initial request, eventually taking the entire application offline.

Vendors: Vaadin.

Quick answers

Is CVE-2026-110803 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110803 being exploited in the wild.
How severe is CVE-2026-110803?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Vaadin Framework 8.16.0 to 8.32.1.
Is there a fix for CVE-2026-110803?: Yes: fixed in 8.32.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110803 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110803?: Check whether you run Vaadin Framework at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 8.32.2

Technical details

VaadinService.requestEnd() holds a session lock while reading the v-uiId request parameter; if the parameter is non-numeric, Integer.parseInt throws an exception within the locked section, preventing the lock from being released in a finally block. Subsequent requests to the same session block indefinitely waiting to acquire the lock, and repeated attacks exhaust the container's thread pool. The attack requires only network access and a valid session cookie; no user interaction or elevated privileges are needed.

Affected products

Vaadin Framework 8.16.0 to 8.32.1

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.