VaadinService.requestEnd() in Vaadin Framework 8 locks a user session and then reads the v-uiId request parameter outside the lock release block. When a request carries a non‑numeric v-uiId, Integer.parseInt throws while the lock is still held, causing the lock to never be released. Subsequent requests to the same session block forever in VaadinService.lockSession(), and repeated requests can exhaust the application’s thread pool, taking the application offline. No authentication is required; any client can obtain a session cookie with a single normal request, making the vulnerability exploitable by any remote user.

Vaadin Framework versions 8.16.0 through 8.32.1 are affected. The vulnerability also affects com.vaadin:vaadin-server and com.vaadin:vaadin-server-mpr-jakarta artifacts within the same version range. Vaadin Framework 7 and Vaadin 10 and later are not impacted.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS information is not available, and it is not listed in the CISA KEV catalog; however, the attack vector is HTTP request manipulation, and the exploit does not require any user authentication beyond a session cookie. An attacker can repeatedly trigger the lock leak to drain the system’s thread pool, resulting in a denial of service. Because the vulnerability can be triggered by any user with a session cookie, its potential impact on availability is significant.