Content Injection Vulnerability in Apache Wicket by Apache
CVE-2026-87718

2.3LOW

Key Information:

Vendor

Apache
Status
Apache Wicket
Vendor
CVE Published:
1 November 2026

What is CVE-2026-87718?

Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0 improperly handle the Content-Security-Policy headers when a render request handler is wrapped in multiple IRequestHandlerDelegate layers. This limitation allows pages to be served without necessary CSP headers even when CSP is enabled within the application, leading to potential content injection attacks. It is crucial to upgrade to versions 10.12.0 or 9.25.0 to ensure CSP protection is correctly enforced, securing applications from vulnerabilities that arise from this oversight.

Affected Version(s)

Apache Wicket 9.24.0

Apache Wicket 10.10.0 <= 10.11.0

References

https://lists.apache.org/thread.html/fjq8v35zpkbtjwpzwkkp...
vendor-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hans Schäfer
.