Resource Allocation Flaw in Apache Wicket Affects File Upload Functionality

CVE-2026-84170

What is CVE-2026-84170?

The vulnerability in Apache Wicket arises when the FileUploadToResourceField permits resource allocation without effective limits or throttling on file uploads. Specifically, the server-side component responsible for managing uploads does not bind predefined upload configuration parameters, allowing clients to specify excessively large values for request size, part size, and number of parts. This oversight can lead to denial-of-service conditions by consuming server resources disproportionately, as no authorization mechanism is present to restrict access. Therefore, it is critical for applications using the affected versions to implement the recommended upgrades for addressing these concerns.

References