CVE-2026-82559 Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation

Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettingsnewWebSocketRequest wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every...