{"id":"CVE-2026-84170","kind":"vulnerability","aliases":["CVE-2026-84170"],"related":[],"title":"Apache Wicket: upload resource lets clients set their own size limits","description":"Allocation of resources without limits or throttling in Apache Wicket.\n\norg.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource rather than through a Form. The resource is an application-wide singleton with no component to consult, so newResourceResponse() takes the three limits that bound the upload - the total request size, the maximum size of a single part and the maximum number of parts - from the request parameters maxSize, fileMaxSize and fileCountMax, and hands them to the multipart parser as they arrive. Nothing binds those numbers to the field that is supposed to be uploading. A request naming a very large maxSize is therefore parsed with no effective ceiling on the total size, and omitting fileMaxSize and fileCountMax leaves the per-part and part-count limits unset as well. The values the application configured through FileUploadToResourceField#setMaxSize(), #setFileMaxSize() and #setFileCountMax() are consulted only when the client omits the corresponding parameter, so against a client that supplies one they have no effect at all.\n\nParts above the parser's in-memory threshold are spooled to the container's temporary directory, and the file parts are then copied into the folder the application's IUploadsFileManager owns, under a sub-folder the request names, where they remain. A part that is not a file is read into the heap in full while the request is parsed. One request, repeatable, can therefore consume as much disk or as much heap as the client chooses to send. The resource carries no authorization annotation and the default authorization strategy permits every resource request, so unless the application authorizes the resource itself the request needs no authentication, no session, no prior page view and no user interaction.\n\nAn application is affected where it uses FileUploadToResourceField, or mounts FileUploadResourceReference itself. This is not the ordinary upload path: the resource is a singleton that has to be created and mounted deliberately. An application that configures no upload limit at all loses nothing, because Wicket applies no total-size limit of its own by default; what the defect removes is a limit the application set. Uploads through Form with FileUploadField, and through AjaxFileDropBehavior, are not affected, because both read their limits from the component rather than from the request. The upload resource does not exist in the 8.x line.\n\nThis issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.9.1. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.","summary":"The form-less file upload resource in Apache Wicket reads its size and part-count limits from request parameters instead of the application's configuration. A remote client can therefore send uploads of any size, filling disk and heap on the server.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-wicket","file-upload","java","package"],"not_affected_if":["no-upload-resource-mounted","uses-form-fileuploadfield-only","wicket-8.x"],"how_to_check":"- Check the Wicket version in the build file (for example `pom.xml` or `build.gradle`) and see whether it falls in 9.14.0 through 9.24.0 or 10.0.0 through 10.9.1.\n- Search the code for `FileUploadToResourceField` or `FileUploadResourceReference`; these are the only affected uses.","fix":"- Apache Wicket 9.x: upgrade to `9.25.0`\n- Apache Wicket 10.x: upgrade to `10.12.0`","status":"open","published_at":"2026-11-01T23:17:29+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","triaged_at":"2026-11-01T23:23:22+00:00","updated_at":"2026-11-01T23:23:22+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-01T23:23:22Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Wicket 9.x: upgrade to `9.25.0`\n- Apache Wicket 10.x: upgrade to `10.12.0`","reach":"internet","title":"Apache Wicket: upload resource lets clients set their own size limits","impact":"medium","summary":"The form-less file upload resource in Apache Wicket reads its size and part-count limits from request parameters instead of the application's configuration. A remote client can therefore send uploads of any size, filling disk and heap on the server.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","apache-wicket","file-upload"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"remote client exhausts server disk and heap via uploads","analyst_note":"","how_to_check":"- Check the Wicket version in the build file (for example `pom.xml` or `build.gradle`) and see whether it falls in 9.14.0 through 9.24.0 or 10.0.0 through 10.9.1.\n- Search the code for `FileUploadToResourceField` or `FileUploadResourceReference`; these are the only affected uses.","plain_action":"","needs_analyst":false,"not_affected_if":["uses-form-fileuploadfield-only","wicket-8.x","no-upload-resource-mounted"],"who_is_affected":"Only applications that use FileUploadToResourceField or mount FileUploadResourceReference themselves are exposed. Uploads through Form with FileUploadField and through AjaxFileDropBehavior are not affected, and the 8.x line has no upload resource. The resource needs no authentication by default unless the application authorizes it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000789,"input_tokens":4863,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-84170':14A,17A '10.0.0':480C '10.12.0':492C '10.9.1':482C '8':467C '9.14.0':476C '9.24.0':478C '9.25.0':490C 'affect':372C,445C,472C 'ajaxfiledropbehavior':442C 'alloc':70C 'annot':336C 'apach':1A,19B,34B,78C,473C 'apache-wicket':18B 'appli':414C 'applic':50B,114C,219C,278C,349C,370C,402C,433C 'application-wid':113C 'arriv':166C 'authent':358C 'author':335C,340C,350C 'bind':168C 'bound':129C 'carri':333C 'ceil':193C 'choos':328C 'client':6A,55B,232C,240C,327C 'compon':119C,453C 'configur':52B,220C,404C 'consult':121C,228C 'consum':317C 'contain':263C 'copi':273C 'correspond':235C 'count':42B,211C 'creat':397C 'cve':12A,15A 'default':339C,424C 'defect':427C 'deliber':400C 'directori':266C 'disk':64B,320C 'effect':192C,247C 'everi':343C 'exist':464C 'field':173C 'file':22B,30B,98C,269C,299C 'file-upload':21B 'filecountmax':156C,202C 'filemaxs':154C,200C 'fileuploadfield':439C 'fileuploadresourcerefer':379C 'fileuploadtoresourcefield':93C,222C,376C 'fill':63B 'fix':494C 'folder':276C,286C 'form':28B,88C,108C,437C 'form-less':27B,87C 'full':306C 'hand':158C 'heap':66B,304C,324C 'in-memori':255C 'instead':47B 'interact':368C 'issu':471C,496C 'iuploadsfilemanag':280C 'java':24B 'larg':185C 'leav':203C 'less':29B,89C 'let':5A 'limit':11A,43B,74C,127C,212C,407C,419C,431C,450C 'line':469C 'lose':410C 'maximum':137C,145C 'maxsiz':153C,186C 'memori':257C 'mount':102C,378C,399C 'much':319C,323C 'multipart':162C 'name':182C,289C 'need':356C 'newresourcerespons':123C 'noth':167C,411C 'number':146C,170C 'offer':91C 'omit':199C,233C 'one':243C,312C 'ordinari':385C 'org.apache.wicket.markup.html.form.upload.resource.abstractfileuploadresource':80C 'own':281C 'packag':25B 'page':363C 'paramet':46B,152C,236C 'pars':189C,311C 'parser':163C,253C 'part':41B,142C,148C,207C,210C,250C,270C,294C 'part-count':40B,209C 'path':387C 'per':206C 'per-part':205C 'permit':342C 'post':95C 'prior':362C 'rather':104C,454C 'read':36B,301C,448C 'recommend':485C 'remain':292C 'remot':54B 'remov':428C 'repeat':314C 'request':45B,134C,151C,181C,288C,309C,313C,345C,355C,458C 'resourc':4A,32B,72C,103C,110C,332C,344C,352C,389C,461C 'select':97C 'send':58B,330C 'separ':101C 'server':69B,83C 'session':360C 'set':7A,434C 'setfilecountmax':226C 'setfilemaxs':224C 'setmaxs':223C 'side':84C 'singl':141C 'singleton':116C,392C 'size':10A,38B,62B,135C,138C,197C,418C 'spool':260C 'strategi':341C 'sub':285C 'sub-fold':284C 'suppli':242C 'suppos':176C 'take':124C 'temporari':265C 'therefor':57B,188C,316C 'three':126C 'threshold':258C 'throttl':76C 'total':133C,196C,417C 'total-s':416C 'unless':347C 'unset':213C 'upgrad':487C 'upload':3A,23B,31B,59B,90C,131C,179C,386C,406C,435C,460C 'use':375C 'user':367C,483C 'valu':217C 'version':489C 'view':364C 'well':215C 'wicket':2A,20B,35B,79C,413C,474C 'wide':115C 'without':73C 'x':468C","nicknames":[],"mitigations":[],"who_affected":"Only applications that use FileUploadToResourceField or mount FileUploadResourceReference themselves are exposed. Uploads through Form with FileUploadField and through AjaxFileDropBehavior are not affected, and the 8.x line has no upload resource. The resource needs no authentication by default unless the application authorizes it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-11-01T23:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84170","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84170","severity":null,"published_at":"2026-11-01T23:17:29+00:00","modified_at":"2026-11-01T23:17:29+00:00","first_seen_at":"2026-11-01T23:22:40+00:00","fetched_at":"2026-11-01T23:22:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}