Input Validation Flaw in Apache Wicket Affects Web Application Security

CVE-2026-76984

What is CVE-2026-76984?

An input validation flaw in Apache Wicket allows for improper neutralization of input during web page generation. The issue arises in the MetaDataHeaderItem class, where attribute names are escaped, but attribute values are not effectively sanitized. This can lead to an attacker injecting a double quote, which prematurely terminates an HTML attribute, resulting in unintended parsing of additional attributes. This vulnerability affects versions 8.0.0 through 10.10.0, including unsupported older releases, putting applications at risk when influenced by attacker-controlled data. It is critical for users to update to the latest versions to mitigate this security risk.

References