# CVE-2026-84170: Apache Wicket resource exhaustion in file upload without limits

Source: https://junglewise.ai/threats/cve-2026-84170-allocation-of-resources-without-limits-or-throttling-in-apache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-01. Updated: 2026-11-01  
License: CC BY 4.0 with a link back

CVE-2026-84170 · Severity: info · Published 2026-11-01

Apache Wicket is a Java web application framework that includes a component for handling file uploads. A vulnerability in the AbstractFileUploadResource allows unauthenticated attackers to exhaust disk and memory by uploading arbitrarily large files, since the component ignores size limits configured by developers in favor of client-supplied parameters. This can cause denial of service or disk space exhaustion on the web server.

Technologies: [Apache Wicket](https://junglewise.ai/threats/technologies/apache-wicket). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-84170 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84170 being exploited in the wild.

**How severe is CVE-2026-84170?** Informational severity, published 1 November 2026.

**Which products and versions are affected?** Apache Wicket 9.14.0 through 9.24.0, 10.0.0 through 10.9.1.

**Is there a fix for CVE-2026-84170?** Yes: fixed in 9.25.0, 10.12.0. Until then: Applications that do not explicitly mount FileUploadResourceReference or use FileUploadToResourceField are unaffected. Standard uploads via Form with FileUploadField or AjaxFileDropBehavior are not vulnerable and should be used instead of the resource-based upload path. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84170 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84170?** Check whether you run Apache Wicket at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 9.25.0, 10.12.0

Applications that do not explicitly mount FileUploadResourceReference or use FileUploadToResourceField are unaffected. Standard uploads via Form with FileUploadField or AjaxFileDropBehavior are not vulnerable and should be used instead of the resource-based upload path.

## Technical details

The AbstractFileUploadResource parses upload size limits (maxSize, fileMaxSize, fileCountMax) from untrusted request parameters rather than enforcing the application's configured limits via FileUploadToResourceField. Requests without authentication can upload unbounded data; file parts are spooled to disk and non-file parts are read into heap, allowing a single request to consume arbitrary disk or memory. The vulnerability affects applications that explicitly mount FileUploadResourceReference or use FileUploadToResourceField.

## Affected products

- Apache Wicket 9.14.0 through 9.24.0, 10.0.0 through 10.9.1

## Timeline

- 2026-11-01: disclosed

## Related threats

- [Apache Wicket improper input neutralization in JavaScript generation](https://junglewise.ai/threats/cve-2026-95863-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket missing Content-Security-Policy headers with nested request handler delegates](https://junglewise.ai/threats/cve-2026-87718-apache-wicket-10-10-0-10-11-0-and-9-24-0-do-not-set-the-content)
- [Apache Wicket ExternalLink reflected XSS in onclick attribute](https://junglewise.ai/threats/cve-2026-84231-improper-neutralization-of-input-during-web-page-generation-in)
- [Apache Wicket path validation bypass in package resource handling](https://junglewise.ai/threats/cve-2026-84177-incorrect-behavior-order-in-apache-wicket-a-file-path-is)
- [Apache Wicket template disclosure via class loader misconfiguration](https://junglewise.ai/threats/cve-2026-84172-files-accessible-to-external-parties-in-apache-wicket-org-apache)