Is CVE-2026-84170 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84170 being exploited in the wild.

How severe is CVE-2026-84170?

Informational severity, published 1 November 2026.

Which products and versions are affected?

Apache Wicket 9.14.0 through 9.24.0, 10.0.0 through 10.9.1.

How is CVE-2026-84170 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84170?

Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84170: Apache Wicket resource exhaustion in file upload without limits

CVE-2026-84170 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework that includes a component for handling file uploads. A vulnerability in the AbstractFileUploadResource allows unauthenticated attackers to exhaust disk and memory by uploading arbitrarily large files, since the component ignores size limits configured by developers in favor of client-supplied parameters. This can cause denial of service or disk space exhaustion on the web server.

Technologies: Apache Wicket. Vendors: Apache.

Quick answers

Is CVE-2026-84170 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84170 being exploited in the wild.
How severe is CVE-2026-84170?: Informational severity, published 1 November 2026.
Which products and versions are affected?: Apache Wicket 9.14.0 through 9.24.0, 10.0.0 through 10.9.1.
Is there a fix for CVE-2026-84170?: Yes: fixed in 9.25.0, 10.12.0. Until then: Applications that do not explicitly mount FileUploadResourceReference or use FileUploadToResourceField are unaffected. Standard uploads via Form with FileUploadField or AjaxFileDropBehavior are not vulnerable and should be used instead of the resource-based upload path. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84170 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84170?: Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 9.25.0, 10.12.0

Applications that do not explicitly mount FileUploadResourceReference or use FileUploadToResourceField are unaffected. Standard uploads via Form with FileUploadField or AjaxFileDropBehavior are not vulnerable and should be used instead of the resource-based upload path.

Technical details

The AbstractFileUploadResource parses upload size limits (maxSize, fileMaxSize, fileCountMax) from untrusted request parameters rather than enforcing the application's configured limits via FileUploadToResourceField. Requests without authentication can upload unbounded data; file parts are spooled to disk and non-file parts are read into heap, allowing a single request to consume arbitrary disk or memory. The vulnerability affects applications that explicitly mount FileUploadResourceReference or use FileUploadToResourceField.

Affected products

Apache Wicket 9.14.0 through 9.24.0, 10.0.0 through 10.9.1

Timeline

2026-11-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.