diff --git a/java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qhelp b/java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qhelp index 4e192da4d26..432e29f99d0 100644 --- a/java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qhelp +++ b/java/ql/src/experimental/Security/CWE/CWE-400/ThreadResourceAbuse.qhelp @@ -13,7 +13,7 @@ of a server's threads to sleep, leading to denial of service.

To guard against this attack, consider specifying an upper range of allowed sleep time or adopting -the producer/consumer design pattern with Thread.wait method to avoid performance +the producer/consumer design pattern with Object.wait method to avoid performance problems or even resource exhaustion.

@@ -28,12 +28,17 @@ check on maximum allowed sleep time is enforced.

  • snyk: Denial of Service (DoS) -Affecting com.googlecode.gwtupload:gwtupload artifact. +in com.googlecode.gwtupload:gwtupload.
  • -gwtupload +gwtupload: [Fix DOS issue] Updating the AbstractUploadListener.java file.
  • +
  • +The blog of a gypsy engineer: + +CVE-2019-17555: DoS via Retry-After header in Apache Olingo. +