CVE-2024-53299: Apache Wicket: An attacker can intentionally trigger a memory leak

Pedro Santos <[email protected]> Thu, 23 Jan 2025 12:21:57 -0300

Newsgroups	gmane.comp.version-control.subversion.user,gmane.comp.java.wicket.devel
Message-ID	<CACvbKQa=2_h0pAwh6Nq1Tze7LY=SPCpyjskwE7=4oeA0NGtiUw__20375.381868665$1737645749$gmane$org@mail.gmail.com>

Severity: critical

Affected versions:

- Apache Wicket 7.0.0 through 7.18.*
- Apache Wicket 8.0.0-M1 through 8.16.*
- Apache Wicket 9.0.0-M1 through 9.18.*
- Apache Wicket 10.0.0-M1 through 10.2.*

Description:

The request handling in the core in Apache Wicket 7.0.0 on any platform
allows an attacker to create a DOS via multiple requests to server
resources.
Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes
this issue.

Credit: (finder)

References:

https://lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5
https://wicket.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-53299