Allocation of Resources Without Limits or Throttling in Apache Wicket - CVE-2026-71257
Published: August 31, 2026
Vulnerability identifier: #VU146318
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-71257
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass configured file upload limits and cause excessive memory consumption.
The vulnerability exists due to improper enforcement of upload restrictions in multipart upload handling when the multipart request has already been parsed by another component. A remote attacker can submit oversized or more numerous uploaded parts to bypass configured file upload limits and cause excessive memory consumption.
The issue affects upload handling paths that fall back to HttpServletRequest#getParts(), and a part without a Content-Type header is read fully into memory during parsing. Applications are affected only if per-file or file-count limits are configured.
Affected software
Apache Wicket
How to mitigate CVE-2026-71257
Install security update from vendor's website.
Apache Wicket - addressed in versions 8.19.0, 9.24.0, 10.11.0