EUVD-2026-114897

Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback rea...

CVE-2026-83594

Apache Wicket versions 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0 are vulnerable to memory exhaustion via the FileUploadToResourceField component. The root cause is that the Ajax callback for this component processes a client-supplied filesInfo JSON array without validating the provided siz...