File Upload Limit Bypass in Apache Wicket by Apache

CVE-2026-71257

What is CVE-2026-71257?

A vulnerability in Apache Wicket allows remote attackers to bypass file upload limits configured in forms or upload fields. When a multipart request is parsed using Apache Commons FileUpload, if the request body is already consumed, Wicket falls back on using HttpServletRequest#getParts(). Consequently, this bypasses individual file size limits and the maximum file count, permitting the upload of files exceeding intended restrictions. Notably, parts lacking a Content-Type header are read entirely into memory, posing a memory allocation risk. This issue impacts versions from 8.0.0 to 8.18.0, 9.0.0 to 9.23.0, and 10.0.0 to 10.10.0, prompting users to upgrade to fixed versions or apply specific configuration limits to mitigate the risk.

References