CVE-2026-83594

Apache Wicket versions 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0 are vulnerable to memory exhaustion via the FileUploadToResourceField component. The root cause is that the Ajax callback for this component processes a client-supplied filesInfo JSON array without validating the provided siz...