GHSA-9cxr-76pm-j3wf
Apache Wicket: An attacker can intentionally trigger a memory leak
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.apache.wicket:wicket-core | >= 7.0.0, < 8.17.0 | 8.17.0 |
| Maven | org.apache.wicket:wicket-core | >= 10.0.0, < 10.3.0 | 10.3.0 |
| Maven | org.apache.wicket:wicket-core | >= 9.0.0-M1, < 9.19.0 | 9.19.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources.
Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.
References
External links from the advisory. They lead to third-party sites.