{"id":"CVE-2026-83594","kind":"vulnerability","aliases":["CVE-2026-83594"],"related":[],"title":"Apache Wicket: unauthenticated upload callback lets requests exhaust server heap memory","description":"Memory allocation with an excessive size value in Apache Wicket.\n\norg.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback reads the request parameter filesInfo, a JSON array carrying a client file name, a size and a content type for each file, and turns it into the list of FileUploadToResourceField.UploadInfo that onUploadSuccess() receives. Nothing binds that JSON to an upload the resource performed and nothing re-derives it from the stored files, so the number of entries and every value in them are whatever the request supplied. The callback URL is rendered into the page, no prior upload is required, and both GET and POST reach it, so any client that can load the page can have the component report files that were never uploaded, without authenticating beyond whatever the page itself requires and without any user interaction.\n\nUploadInfo#get(), which the class offers as the way to obtain the bytes of an upload, allocates a byte array from UploadInfo#getSize() before it opens the file. The array is therefore sized by the number the request supplied, and the allocation happens even for a file that was never stored. One small request can cost the server close to two gigabytes of heap, and the request is trivially repeatable, so a few of them exhaust the heap for every request the Java virtual machine is serving. A size that the conversion to int turns negative instead throws NegativeArraySizeException, which the exception handler inside that method does not cover, so it escapes into the application.\n\nAn application is affected where it uses FileUploadToResourceField, which is not the ordinary upload path through FileUploadField and Form and has to be extended and mounted deliberately. The allocation additionally requires the application to call UploadInfo#get() rather than reading UploadInfo#getFile() itself. Where the application denies the ENABLE action on the field through its authorization strategy, the callback is refused like any other listener. The 8.x line does not contain this component and is not affected.\n\nThis issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.","summary":"The FileUploadToResourceField Ajax callback in Apache Wicket trusts a client-supplied filesInfo JSON, so UploadInfo#get() allocates a byte array sized by the request value. A single small request can make the server allocate close to two gigabytes, and repeated requests can exhaust the Java heap for the whole application.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","java","package","web-apps"],"not_affected_if":["denies-enable-action","uses-fileuploadfield-only","uses-getfile-not-get","wicket-8-line"],"how_to_check":"- Check whether the application uses `FileUploadToResourceField` (search the code for this class) and calls `UploadInfo#get()` rather than `UploadInfo#getFile()`.\n- Check the Wicket version in the build file, for example `wicket-core` at `9.24.0` or `10.11.0` or earlier is affected.\n- Confirm the Wicket version range: `9.14.0` through `9.24.0`, and `10.0.0` through `10.11.0`.","fix":"- Apache Wicket `9.x` line: upgrade to `9.25.0`\n- Apache Wicket `10.x` line: upgrade to `10.12.0`\n- The 8.x line does not contain this component and is not affected.","status":"open","published_at":"2026-11-01T23:17:29+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","triaged_at":"2026-11-01T23:23:23+00:00","updated_at":"2026-11-01T23:23:23+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T23:23:23Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Wicket `9.x` line: upgrade to `9.25.0`\n- Apache Wicket `10.x` line: upgrade to `10.12.0`\n- The 8.x line does not contain this component and is not affected.","reach":"internet","title":"Apache Wicket: unauthenticated upload callback lets requests exhaust server heap memory","impact":"medium","summary":"The FileUploadToResourceField Ajax callback in Apache Wicket trusts a client-supplied filesInfo JSON, so UploadInfo#get() allocates a byte array sized by the request value. A single small request can make the server allocate close to two gigabytes, and repeated requests can exhaust the Java heap for the whole application.","audience":"developers","category":"package","nicknames":[],"who_cares":["apache-wicket","java","web-apps"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated requests exhaust server heap and crash the Java application","analyst_note":"","how_to_check":"- Check whether the application uses `FileUploadToResourceField` (search the code for this class) and calls `UploadInfo#get()` rather than `UploadInfo#getFile()`.\n- Check the Wicket version in the build file, for example `wicket-core` at `9.24.0` or `10.11.0` or earlier is affected.\n- Confirm the Wicket version range: `9.14.0` through `9.24.0`, and `10.0.0` through `10.11.0`.","plain_action":"","needs_analyst":false,"not_affected_if":["wicket-8-line","uses-fileuploadfield-only","denies-enable-action","uses-getfile-not-get"],"who_is_affected":"Applications built on Apache Wicket 9.14.0 to 9.24.0 or 10.0.0 to 10.11.0 that extend and mount FileUploadToResourceField and call UploadInfo#get(). Applications that use the ordinary FileUploadField and Form upload path, or that deny the ENABLE action on the field through their authorization strategy, are not exposed by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000853,"input_tokens":4752,"output_tokens":756,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-83594':14A,17A '10.0.0':435C '10.11.0':437C '10.12.0':447C '8':413C '9.14.0':431C '9.24.0':433C '9.25.0':445C 'action':396C 'addit':376C 'affect':350C,424C,427C 'afterward':105C 'ajax':28B,109C 'alloc':43B,60B,78C,248C,273C,375C 'apach':1A,19B,31B,85C,428C 'apache-wicket':18B 'app':25B 'applic':76B,346C,348C,379C,392C 'array':46B,120C,251C,261C 'authent':220C 'author':402C 'beyond':221C 'bind':147C 'byte':45B,244C,250C 'call':381C 'callback':5A,29B,110C,112C,182C,405C 'carri':121C 'class':236C 'client':36B,123C,203C 'client-suppli':35B 'close':61B,290C 'compon':212C,420C 'contain':418C 'content':130C 'convers':323C 'cost':287C 'cover':340C 'cve':12A,15A 'deliber':373C 'deni':393C 'deriv':160C 'enabl':395C 'entri':170C 'escap':343C 'even':275C 'everi':172C,311C 'except':333C 'excess':81C 'exhaust':8A,69B,307C 'extend':370C 'field':399C 'file':89C,124C,134C,165C,214C,259C,278C 'filesinfo':38B,117C 'fileuploadfield':363C 'fileuploadtoresourcefield':27B,354C 'fileuploadtoresourcefield.uploadinfo':142C 'fix':449C 'form':99C,365C 'get':42B,196C,233C,383C 'getfil':388C 'getsiz':254C 'gigabyt':64B,293C 'handler':334C 'happen':274C 'heap':10A,72B,295C,309C 'insid':335C 'instead':328C 'int':325C 'interact':231C 'issu':426C,451C 'java':21B,71B,314C 'json':39B,119C,149C 'let':6A 'like':408C 'line':415C 'list':140C 'listen':411C 'load':206C 'machin':316C 'make':57B 'memori':11A,77C 'method':337C 'mount':93C,372C 'name':125C 'negat':327C 'negativearraysizeexcept':330C 'never':217C,281C 'noth':146C,157C 'number':168C,267C 'obtain':242C 'offer':237C 'one':283C 'onuploadsuccess':144C 'open':257C 'ordinari':359C 'org.apache.wicket.markup.html.form.upload.resource.fileuploadtoresourcefield':87C 'outcom':104C 'packag':22B 'page':188C,208C,224C 'paramet':116C 'path':361C 'perform':155C 'post':198C 'prior':190C 'rather':95C,384C 're':159C 're-der':158C 'reach':199C 'read':113C,386C 'receiv':145C 'recommend':440C 'refus':407C 'render':185C 'repeat':66B,301C 'report':213C 'request':7A,50B,55B,67B,115C,179C,269C,285C,298C,312C 'requir':193C,226C,377C 'resourc':94C,154C 'separ':92C 'serv':318C 'server':9A,59B,289C 'singl':53B 'size':47B,82C,127C,264C,320C 'small':54B,284C 'store':164C,282C 'strategi':403C 'suppli':37B,180C,270C 'therefor':263C 'throw':329C 'told':102C 'trivial':300C 'trust':33B 'turn':136C,326C 'two':63B,292C 'type':131C 'unauthent':3A 'upgrad':442C 'upload':4A,88C,152C,191C,218C,247C,360C 'uploadinfo':41B,232C,253C,382C,387C 'url':183C 'use':353C 'user':230C,438C 'valu':51B,83C,173C 'version':444C 'virtual':315C 'way':240C 'web':24B 'web-app':23B 'whatev':177C,222C 'whole':75B 'wicket':2A,20B,32B,86C,429C 'without':219C,228C 'x':414C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Wicket 9.14.0 to 9.24.0 or 10.0.0 to 10.11.0 that extend and mount FileUploadToResourceField and call UploadInfo#get(). Applications that use the ordinary FileUploadField and Form upload path, or that deny the ENABLE action on the field through their authorization strategy, are not exposed by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T23:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83594","severity":null,"published_at":"2026-11-01T23:17:29+00:00","modified_at":"2026-11-01T23:17:29+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","fetched_at":"2026-11-01T23:22:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}