VulnerableCode Package Details - pkg:maven/com.vaadin/flow@3.0.4

Search for packages

Vulnerability	Summary	Fixed by
VCID-2fz6-rucr-xqax Aliases: CVE-2021-31406 GHSA-p7jq-v8jp-j424	Information Exposure Through Discrepancy Non-constant-time comparison of CSRF tokens in endpoint request handler allows attacker to guess a security token for Fusion endpoints via timing attack.	5.0.4 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 6.0.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-bud2-81n2-wyhc Aliases: CVE-2021-31411 GHSA-p826-8vhq-h439	Insecure Temporary File Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server allows local users to inject malicious code into frontend resources during application rebuilds.	6.0.7 Affected by 0 other vulnerabilities.
VCID-hqrf-7nbq-9bdw Aliases: CVE-2021-31404 GHSA-xwg3-qrcg-w9x6	Information Exposure Through Discrepancy A non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` allows attacker to guess a security token via timing attack.	5.0.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-2fz6-rucr-xqax
Aliases:
CVE-2021-31406
GHSA-p7jq-v8jp-j424

Information Exposure Through Discrepancy Non-constant-time comparison of CSRF tokens in endpoint request handler allows attacker to guess a security token for Fusion endpoints via timing attack.

5.0.4
Affected by 2 other vulnerabilities.

6.0.1
Affected by 1 other vulnerability.

VCID-bud2-81n2-wyhc
Aliases:
CVE-2021-31411
GHSA-p826-8vhq-h439

Insecure Temporary File Insecure temporary directory usage in frontend build functionality of com.vaadin:flow-server allows local users to inject malicious code into frontend resources during application rebuilds.

6.0.7
Affected by 0 other vulnerabilities.

VCID-hqrf-7nbq-9bdw
Aliases:
CVE-2021-31404
GHSA-xwg3-qrcg-w9x6

Information Exposure Through Discrepancy A non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` allows attacker to guess a security token via timing attack.

5.0.0
Affected by 3 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:50:27.599122+00:00	GitLab Importer	Affected by	VCID-bud2-81n2-wyhc	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.vaadin/flow/CVE-2021-31411.yml	38.6.0
2026-06-04T20:50:03.946135+00:00	GitLab Importer	Affected by	VCID-hqrf-7nbq-9bdw	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.vaadin/flow/CVE-2021-31404.yml	38.6.0
2026-06-04T20:50:00.432948+00:00	GitLab Importer	Affected by	VCID-2fz6-rucr-xqax	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/com.vaadin/flow/CVE-2021-31406.yml	38.6.0