GitHub Advisoryadvisory · Maven

GHSA-9cxr-76pm-j3wf Apache Wicket: An attacker can intentionally trigger a memory leak

MEDIUM Published 2025-01-23 Modified 2025-03-11 Official page ↗
Aliases
CVE-2024-53299
Ecosystem
Maven
Packages
org.apache.wicket:wicket-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2025-01-23

Affected packages

• Maven org.apache.wicket:wicket-core: >= 7.0.0, < 8.17.0 → fixed in 8.17.0 • Maven org.apache.wicket:wicket-core: >= 10.0.0, < 10.3.0 → fixed in 10.3.0 • Maven org.apache.wicket:wicket-core: >= 9.0.0-M1, < 9.19.0 → fixed in 9.19.0

Description

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.

Related

Alias · CVE (1)

  • CVE-2024-53299 The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References