EUVD-2026-114889

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...