A vulnerability in Apache Wicket allows unauthenticated remote attackers to bypass file upload constraints, potentially leading to a denial of service through resource exhaustion.

This vulnerability is a resource exhaustion flaw (CWE-770) occurring when the application falls back to HttpServletRequest#getParts() during multipart processing. Unauthenticated attackers can submit excessive or oversized files because the framework fails to apply configured per-file size and count limits in this fallback state.

The ability for an attacker to bypass file upload limits poses a significant risk of denial of service. By submitting numerous or excessively large files, an attacker can exhaust system memory or disk space, rendering the application unavailable to legitimate users. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent operational disruption and potential system instability.

Immediate Action: Organizations should monitor vendor channels for the release of patched versions of Apache Wicket and apply them as soon as they become available.

Proactive Monitoring: Security teams should review web server logs for unusually large or frequent file upload requests that may indicate an attempt to exploit this resource limit bypass.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to enforce payload size limits and monitor for high volumes of multipart requests that could indicate exploitation.

Public Exploit Available: No

Given the potential for service disruption and the lack of a current patch, administrators must prioritize identifying all instances of Apache Wicket within their environment. Organizations should proactively implement rate limiting and request size filtering at the network perimeter to mitigate the risk until official updates are deployed.