CWE-572
Call to Thread run() instead of start()
The product calls a thread's run() method instead of calling start(), which causes the code to run in the thread of the caller instead of the callee.
Impactr finds and proves whether CWE-572 — or flaws like it — are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.