EUVD-2026-114889

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...

CVE-2026-82559

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...

CVE-2026-82559 Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...

CVE-2026-82559: Apache Software Foundation Apache Wicket: Insufficient session expiration in Apache Wicket

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...

PT-2026-135041

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...