Apache Wicket fixes 19 flaws across three supported releases

SecurityOnline[.]info reports that Apache Wicket has disclosed 19 security flaws across the 8.20.0, 9.25.0 and 10.12.0 branches. Do Son, writing for the outlet, notes that nine of the flaws are rated high severity, with two of the top issues scoring 8.3 on CVSS v4. The publication states that there is currently no confirmed exploitation in the wild, and lists the highest-severity vulnerability as CVE-2026-84170, tied to upload resource exhaustion.

The advisory also identifies CVE-2026-83594 as another 8.3-rated upload-related flaw. SecurityOnline[.]info says all three versions should be patched to the latest releases: 8.20.0, 9.25.0 and 10.12.0.

The outlet itemises affected versions as Apache Wicket 8.0.0 through 8.19.0, 9.0.0 through 9.24.0, and 10.0.0 through 10.11.0, with some flaws affecting narrower ranges and two upload bugs beginning at 9.14.0. It highlights six cross-site scripting bugs, five missing authorization checks and two denial-of-service issues via file uploads, alongside other concerns such as session fixation, file exposure and a missing Content-Security-Policy header.

The most notable CVEs include CVE-2026-84170, CVE-2026-83594, CVE-2026-111089, CVE-2026-95863, CVE-2026-82956, CVE-2026-84231, CVE-2026-83559, and CVE-2026-83539, all described as not exploited at the time of reporting. SecurityOnline[.]info urges upgrading to the patched releases and, in the meantime, auditing FileUploadToResourceField usage and JavaScriptUtils#escapeQuotes() calls. The article attributes these findings to the Apache Wicket project advisory and its vulnerability notes.