Description
An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service.
Remediation
References
https://github.com/manolo/gwtupload/issues/33
https://logicaltrust.net/blog/2020/02/gwt-upload.html
Related Vulnerabilities
CVE-2021-23901 Vulnerability in maven package org.apache.nutch:nutch
CVE-2021-37712 Vulnerability in npm package tar
CVE-2023-40816 Vulnerability in maven package org.opencrx:opencrx-core-models
CVE-2019-5475 Vulnerability in maven package org.sonatype.nexus.plugins:nexus-yum-repository-plugin
CVE-2020-7686 Vulnerability in npm package rollup-plugin-dev-server