Description
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.
Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Wicket | 7.0.0 – ≤ 7.18.*, 8.0.0-M1 – ≤ 8.16.*, 9.0.0-M1 – ≤ 9.18.*, 10.0.0-M1 – ≤ 10.2.* | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.wicket:wicket-core | >= 7.0.0, < 8.17.0 | 8.17.0 | GHSA-9cxr-76pm-j3wf |
| Maven | org.apache.wicket:wicket-core | >= 10.0.0, < 10.3.0 | 10.3.0 | GHSA-9cxr-76pm-j3wf |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M1, < 9.19.0 | 9.19.0 | GHSA-9cxr-76pm-j3wf |
Advisories 1
- WID-SEC-2025-0195 Apache Wicket: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jan 26, 2025
References
- https://lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5 vendor-advisory