title: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
description: Unsafe validation RegEx in EmailField component in com.vaadin:vaadin-text-field-flow versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
problem types: CWE-400 Uncontrolled Resource Consumption
affected:
{
product: Vaadin
vendor: Vaadin
versions:
changes: [at: 15.0.0, status: affected], lessThan: *, status: affected, version: 14.0.6, versionType: custom
}
{
product: vaadin-text-field-flow
vendor: Vaadin
versions:
changes: [at: 3.0.0, status: affected], lessThan: *, status: affected, version: 2.0.4, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]