CVE-2026-71257

Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apache Commons FileUpload. If the request body has already been consumed by another component, Commons FileUpload returns no items and Wicket falls back to reading the upload through HttpServletRequest#getParts(). The per-file size limit (for example Form#setFileMaxSize) and the file count limit (Form#setFileCountMax) are not applied to the parts obtained that way, and no exception is raised, so the upload is processed as though those limits had been satisfied. A remote uploader can therefore submit files that are larger, or more numerous, than the application permits, up to whatever the component that parsed the request allows. A part carrying no Content-Type header is additionally read into memory in full during parsing, so the size of that allocation is determined by the request and bounded only by those same external limits. The total upload size limit (Form#setMaxSize) is not affected. Commons FileUpload compares the declared Content-Length against it before reading the body, so a request declaring an oversized length is rejected before the fallback is reached. The fallback is reached in deployments where a servlet or filter has already parsed the request body — for example a servlet annotated with @MultipartConfig, Spring Boot's multipart resolver, or any filter that calls HttpServletRequest#getParameter() on a multipart request. It applies to the Wicket components that accept uploads on that path, including Form with FileUploadField, FileUploadToResourceField and AjaxFileDropBehavior. Applications that configure neither a per-file nor a file-count limit are not affected, as Wicket applies neither by default. This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. As a workaround, configure equivalent limits in the component that parses the request — for example spring.servlet.multipart.max-file-size and max-request-size, or maxFileSize and maxRequestSize in @MultipartConfig or in the web.xml <multipart-config> element.

• CWE-770

• https://lists.apache.org/thread/o59f8jz1m09kqdwm73pyyn6hdsxt190qMailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/08/30/4Mailing List, Third Party Advisory

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-71250Firefly III's webhook URL validator (IsValidWebhookUrl.php) …4.3
• CVE-2026-71251Akaunting's shared download route (app/Http/Controllers/Comm…6.5
• CVE-2026-71252toner-management's admin state-changing handlers (add.php, e…8.2
• CVE-2026-71254nanoMODBUS through v1.23.0 contains an out-of-bounds write i…9.8
• CVE-2026-71255nanoMODBUS through v1.23.0 contains an out-of-bounds write i…8.6
• CVE-2026-71256nanoMODBUS through v1.23.0 contains an out-of-bounds stack r…9.8
• CVE-2026-71259ESPHome through 2026.7.0-dev contains an operator-precedence…8.6
• CVE-2026-7126A security flaw has been discovered in SourceCodester Pharma…7.3
• CVE-2026-71260ESPHome through 2026.7.0-dev discloses plaintext passwords v…6.5
• CVE-2026-71261dr_libs dr_wav.h (all versions through current master) conta…7.8
• CVE-2026-71262IoTSharp BlobStorageController.cs lacks the [Authorize] attr…9.8
• CVE-2026-71263The LINUXTCP port of FreeModbus contains an off-by-one bound…9.1