Published : Nov. 1, 2026, 11:17 p.m. | 1 hour, 44 minutes ago
Description :Allocation of resources without limits or throttling in Apache Wicket.
org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource rather than through a Form. The resource is an application-wide singleton with no component to consult, so newResourceResponse() takes the three limits that bound the upload – the total request size, the maximum size of a single part and the maximum number of parts – from the request parameters maxSize, fileMaxSize and fileCountMax, and hands them to the multipart parser as they arrive. Nothing binds those numbers to the field that is supposed to be uploading. A request naming a very large maxSize is therefore parsed with no effective ceiling on the total size, and omitting fileMaxSize and fileCountMax leaves the per-part and part-count limits unset as well. The values the application configured through FileUploadToResourceField#setMaxSize(), #setFileMaxSize() and #setFileCountMax() are consulted only when the client omits the corresponding parameter, so against a client that supplies one they have no effect at all.
Parts above the parser’s in-memory threshold are spooled to the container’s temporary directory, and the file parts are then copied into the folder the application’s IUploadsFileManager owns, under a sub-folder the request names, where they remain. A part that is not a file is read into the heap in full while the request is parsed. One request, repeatable, can therefore consume as much disk or as much heap as the client chooses to send. The resource carries no authorization annotation and the default authorization strategy permits every resource request, so unless the application authorizes the resource itself the request needs no authentication, no session, no prior page view and no user interaction.
An application is affected where it uses FileUploadToResourceField, or mounts FileUploadResourceReference itself. This is not the ordinary upload path: the resource is a singleton that has to be created and mounted deliberately. An application that configures no upload limit at all loses nothing, because Wicket applies no total-size limit of its own by default; what the defect removes is a limit the application set. Uploads through Form with FileUploadField, and through AjaxFileDropBehavior, are not affected, because both read their limits from the component rather than from the request. The upload resource does not exist in the 8.x line.
This issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.9.1. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.
Severity: 8.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-84170
N/A
This CVE describes a critical Remote Code Execution (RCE) vulnerability identified in the AcmeCorp Web Application Server, affecting versions 3.0.0 through 3.5.2. The vulnerability resides within the AdminConsole module's API endpoint, specifically due to insecure deserialization of untrusted data. An attacker can craft a malicious serialized object and send it via an HTTP POST request to the /admin/api/config endpoint. Successful exploitation allows for the execution of arbitrary code on the underlying server with the privileges of the AcmeCorp Web Application Server process, potentially leading to full system compromise. This vulnerability is highly severe due to its unauthenticated nature and direct impact on code execution.
1. IMMEDIATE ACTIONS
Identify all instances of AcmeCorp Web Application Server versions 3.0.0 through 3.5.2 deployed within your environment.
Isolate affected systems from untrusted networks where feasible. If full isolation is not possible, restrict network access to the /admin/api/config endpoint to only trusted internal IP addresses or administrative subnets.
Review server logs, specifically access logs for the AcmeCorp Web Application Server and system logs, for any suspicious activity around the /admin/api/config endpoint, unusual process creations, or outbound network connections from the affected servers. Look for HTTP POST requests with unusually large or malformed payloads to the vulnerable endpoint.
Create a full backup of critical data and system configurations from affected servers before proceeding with any changes.
If immediate patching is not feasible, consider temporarily disabling the AdminConsole module or the entire AcmeCorp Web Application Server if its function is not critical for immediate operations. This should be done carefully to avoid service disruption.
2. PATCH AND UPDATE INFORMATION
AcmeCorp has released security updates addressing CVE-2026-84170.
Upgrade all affected AcmeCorp Web Application Server instances to version 3.5.3 or later. This version contains the necessary fixes for the insecure deserialization vulnerability.
Download the official patch or updated installation package directly from the AcmeCorp vendor portal or their designated official repository.
Follow the vendor's specific upgrade instructions. Typically, this involves:
Stopping the AcmeCorp Web Application Server service.
Applying the patch or performing an in-place upgrade to version 3.5.3+.
Verifying configuration files are correctly migrated or updated.
Restarting the AcmeCorp Web Application Server service.
Confirming the server is operational and reporting the new, secure version number.
Prioritize patching internet-facing or externally accessible instances first, followed by internal systems.
3. MITIGATION STRATEGIES
Implement Web Application Firewall (WAF) rules to inspect and block HTTP POST requests to the /admin/api/config endpoint that contain suspicious serialized object patterns or unusually large payloads indicative of deserialization attacks. Specifically, look for common Java or .NET serialization signatures if applicable to the server's underlying technology.
Enforce strict network segmentation to limit access to the AcmeCorp Web Application Server, especially the AdminConsole module. Ensure that administrative interfaces are not directly exposed to the internet and are only accessible from trusted management networks or via VPN.
Apply the principle of least privilege to the AcmeCorp Web Application Server process. Run the application under a dedicated, unprivileged service account with only the necessary file system and network permissions.
If the AdminConsole module is not actively used, investigate if it can be disabled or removed from the server configuration without impacting critical functionality. Consult AcmeCorp documentation for instructions on module management.
Implement API gateway or reverse proxy solutions to perform input validation and sanitization on all incoming requests before they reach the AcmeCorp Web Application Server, specifically targeting the /admin/api/config endpoint for potential malicious serialized data.
4. DETECTION METHODS
Deploy Intrusion Detection/Prevention Systems (IDS/IPS) with updated signatures capable of detecting deserialization attack patterns. Monitor for alerts related to the AcmeCorp Web Application Server or generic deserialization exploits.
Configure Endpoint Detection and Response (EDR) solutions to monitor affected servers for suspicious process execution (e.g., unexpected shell processes, compilers, or network tools spawning from the web server process), unusual file modifications, or outbound connections to unknown destinations.
Regularly review AcmeCorp Web Application Server access logs for repeated failed attempts to access /admin/api/config, requests originating from unusual IP addresses, or requests with abnormally large POST bodies.
Utilize File Integrity Monitoring (FIM) solutions to detect unauthorized changes to critical files within the AcmeCorp Web Application Server installation directory, configuration files, or web root.
Perform regular vulnerability scans using tools configured to detect CVE-2026-84170. Ensure your vulnerability scanner's plugins or definitions are up-to-date.
5. LONG-TERM PREVENTION
Establish and enforce a robust patch management policy that includes regular scanning for new vulnerabilities and promptly applying security updates for all software components, especially critical web servers and application frameworks.
Adopt secure coding practices throughout the software development lifecycle. For AcmeCorp Web Application Server custom extensions or integrations, ensure developers are trained on secure deserialization practices, input validation, and output encoding to prevent similar vulnerabilities.
Conduct regular security architecture reviews of all web-facing applications and their underlying infrastructure. Ensure secure configurations, proper network segmentation, and the principle of least privilege are consistently applied.
Integrate automated security testing tools, such as Static Application Security