CVE-2020-13128: Gwtupload Project Gwtupload

High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days.

An issue was discovered in Manolo GWTUpload 1.0.3. server/UploadServlet.java (the servlet for handling file upload) accepts a delay parameter that causes a thread to sleep. It can be abused to cause all of a server's threads to sleep, leading to denial of service.

Affected products

• Gwtupload Project Gwtupload: version 1.0.3 only

Published 2020-05-18. Last modified 2026-06-17.