The Apache Wicket project has disclosed 19 security flaws affecting every supported branch of its Java web framework, urging users to upgrade to the fixed releases issued alongside the announcement on 1 November 2026.

The most serious pair, both rated 8.3 under CVSS version 4, involve file uploads. In one case, configured upload limits are not enforced by the standalone upload resource; in the other, a field accepts a client-supplied upload result and allocates the size it names. The project warns that a small request can cost a server close to two gigabytes of memory, while uploaded parts can also fill disk space.

What else was fixed

Beyond the two upload flaws, the batch includes six cross-site scripting weaknesses, in which attacker-controlled text can be written into generated pages and scripts without proper escaping, and five cases where authorisation checks are missing. The remaining flaws cover session fixation, the exposure of template files, and pages served without the Content-Security-Policy header that applications had enabled.

The flaws affect Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0. The fixed versions are 8.20.0, 9.25.0 and 10.12.0, with release tags published in the project's repository. Users still on version 7.x or older should move to a supported branch, as those releases no longer receive fixes.

What users should do

Administrators should upgrade to the fixed release matching their branch and check whether any application relies on upload fields or on the affected components. No exploitation in the wild and no public proof-of-concept had been confirmed at the time of disclosure, but the breadth of the batch — nine high-severity flaws across all three branches — makes patching, rather than waiting for evidence of attacks, the safer course. Sources: SecurityOnline summary of the Apache Wicket disclosure and CVE records citing the Apache advisory threads.