Severity: important
CVSS 4.0: 8.3 (high)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Affected versions:
- Apache Wicket (org.apache.wicket:wicket-core) 9.14.0 through 9.24.0
- Apache Wicket (org.apache.wicket:wicket-core) 10.0.0 through 10.11.0
Description:
Memory allocation with an excessive size value in Apache Wicket.
org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField
uploads files to a separately mounted resource rather than through a form, and
is told the outcome afterwards over its own Ajax callback. That callback reads
the request parameter filesInfo, a JSON array carrying a client file name, a
size and a content type for each file, and turns it into the list of
FileUploadToResourceField.UploadInfo that onUploadSuccess() receives. Nothing
binds that JSON to an upload the resource performed and nothing re-derives it
from the stored files, so the number of entries and every value in them are
whatever the request supplied. The callback URL is rendered into the page, no
prior upload is required, and both GET and POST reach it, so any client that
can load the page can have the component report files that were never uploaded,
without authenticating beyond whatever the page itself requires and without any
user interaction.
UploadInfo#get(), which the class offers as the way to obtain the bytes of an
upload, allocates a byte array from UploadInfo#getSize() before it opens the
file. The array is therefore sized by the number the request supplied, and the
allocation happens even for a file that was never stored. One small request can
cost the server close to two gigabytes of heap, and the request is trivially
repeatable, so a few of them exhaust the heap for every request the Java
virtual machine is serving. A size that the conversion to int turns negative
instead throws NegativeArraySizeException, which the exception handler inside
that method does not cover, so it escapes into the application.
An application is affected where it uses FileUploadToResourceField, which is
not the ordinary upload path through FileUploadField and Form and has to be
extended and mounted deliberately. The allocation additionally requires the
application to call UploadInfo#get() rather than reading UploadInfo#getFile()
itself. Where the application denies the ENABLE action on the field through its
authorization strategy, the callback is refused like any other listener. The
8.x line does not contain this component and is not affected.
This issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0
through 10.11.0. Users are recommended to upgrade to version 9.25.0 or 10.12.0,
which fix the issue.
Credit:
Emond Papegaaij (finder)
References:
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-83594
