GHSA-9cxr-76pm-j3wfMediumCVSS 6.5

Apache Wicket: An attacker can intentionally trigger a memory leak

Published
January 23, 2025
Last Modified
March 11, 2025

🔗 CVE IDs covered (1)

CVE-2024-53299 →

📋 Description

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.

🎯 Affected products3

  • maven/org.apache.wicket:wicket-core:>= 10.0.0, < 10.3.0
  • maven/org.apache.wicket:wicket-core:>= 7.0.0, < 8.17.0
  • maven/org.apache.wicket:wicket-core:>= 9.0.0-M1, < 9.19.0

🔗 References (5)