Description
An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service.
Remediation
References
https://logicaltrust.net/blog/2020/02/gwt-upload.html
https://github.com/manolo/gwtupload/issues/33
Related Vulnerabilities
CVE-2023-44487 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core
CVE-2020-26302 Vulnerability in maven package org.webjars.npm:is_js
CVE-2023-43961 Vulnerability in maven package cn.dev33:sa-token-core
CVE-2021-23330 Vulnerability in npm package launchpad
CVE-2021-21391 Vulnerability in npm package @ckeditor/ckeditor5-markdown-gfm