EUVD-2026-114898

Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource...

CVE-2026-84170

Apache Wicket versions 9.14.0 through 9.24.0 and 10.0.0 through 10.9.1 are vulnerable to a resource exhaustion flaw in the AbstractFileUploadResource component. The root cause is that configured upload limits (total size, max part size, and max part count) are bypassed when a client provides thei...