Memory Allocation Vulnerability in Apache Wicket File Upload Component

CVE-2026-83594

What is CVE-2026-83594?

A vulnerability exists in the FileUploadToResourceField component of Apache Wicket, allowing unauthenticated requests to potentially consume excessive server resources. The component facilitates file uploads but fails to validate the size of files being uploaded. This can lead to an attacker successfully triggering memory allocation for non-existent files based on manipulated request parameters. Consequently, this may result in severe heap exhaustion, negatively impacting the application's stability. The issue affects several versions of Apache Wicket, and users are advised to upgrade to the recommended secure versions to mitigate the risk.

References