Do Son 
TL;DR
The Apache Wicket project disclosed 19 security flaws on November 1, 2026. These Apache Wicket vulnerabilities touch every supported branch of the Java web framework. The worst two score 8.3 on CVSS v4 and let attackers exhaust server resources through file uploads.
Apache Wicket 8.x, 9.x and 10.x contain six cross-site scripting bugs, five missing authorization checks and two upload denial-of-service flaws. Other bugs cover session fixation, file exposure and a missing Content-Security-Policy header. Upgrade to 8.20.0, 9.25.0 or 10.12.0.
- Total: 19 CVEs
- Severity: 9 High · 6 Medium · 4 Low
- Actively exploited: None confirmed
- Highest severity: 8.3 (High · CVSSv4) — CVE-2026-84170
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Status |
|---|---|---|---|
| CVE-2026-84170 | 8.3 | Configured upload limits are not enforced by the standalone file upload resource | Not exploited |
| CVE-2026-83594 | 8.3 | FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names | Not exploited |
| CVE-2026-111089 | 7.6 | XSS via a resource bundle text written unescaped into generated JavaScript and markup | Not exploited |
| CVE-2026-95863 | 7.6 | XSS via a component id or markup id written unescaped into generated JavaScript and markup | Not exploited |
| CVE-2026-82956 | 7.6 | XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name | Not exploited |
| CVE-2026-84231 | 7.4 | XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag | Not exploited |
| CVE-2026-83559 | 7.4 | JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal | Not exploited |
| CVE-2026-83539 | 7.4 | XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data | Not exploited |
Why It Matters
Wicket builds the pages, forms and JavaScript of many enterprise Java applications. So a framework bug can reach every app built on it, even when the app’s own code is sound. Moreover, nine of the 19 flaws are rated high severity. No exploitation in the wild or public proof-of-concept has been confirmed so far.
How the Attack Works
Upload resource exhaustion (CVE-2026-84170, CVE-2026-83594)
Wicket’s form-less upload field reads its size limits from request parameters. As the advisory notes, “nothing binds those numbers to the field.” An attacker can therefore set a huge limit and flood the server with data. Both flaws score 8.3. One small request “can cost the server close to two gigabytes of heap,” and uploaded parts can fill the disk.
Cross-site scripting (six CVEs)
Several components write text into JavaScript strings or HTML attributes without proper escaping. For example, CVE-2026-111089 covers localized labels, while CVE-2026-83559 shows that escapeQuotes() fails to escape backslashes. In each case, injected script runs “in the application’s origin.” These bugs score between 7.4 and 7.6, and most need the victim to load a page or click a link.
Authorization and session flaws
Five bugs skip authorization checks. For instance, CVE-2026-82557 lets a request trigger a submit button the app had hidden from that user. Another flaw, CVE-2026-82840, skips session ID renewal when a signed-in session logs in again. That gap allows session fixation.
Affected Versions
- Apache Wicket 8.0.0 through 8.19.0
- Apache Wicket 9.0.0 through 9.24.0
- Apache Wicket 10.0.0 through 10.11.0
Some flaws hit narrower ranges. The upload bugs start at 9.14.0, and CVE-2026-82557 affects only 10.3.0 and later. Meanwhile, three WebSocket bugs also reach older, unsupported 6.x or 7.x releases.
Patch and Mitigation
Upgrade to Apache Wicket 8.20.0, 9.25.0 or 10.12.0. Release tags for all three versions are live in the project’s GitHub repository. You can check supported lines on the Apache Wicket versions page. Users of 7.x or older should move to a supported branch, since those releases get no fixes.
Until you patch, review any app that uses FileUploadToResourceField. In addition, check custom code that calls JavaScriptUtils#escapeQuotes(). Fixing these Apache Wicket vulnerabilities closes all 19 issues at once.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
