CVE-2024-53299: Apache Wicket: An attacker can intentionally trigger a memory leak

January 23, 2025 (updated March 11, 2025)

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple requests to server resources. Users are recommended to upgrade to versions 9.19.0 or 10.3.0, which fixes this issue.

References

github.com/advisories/GHSA-9cxr-76pm-j3wf
github.com/apache/wicket
lists.apache.org/thread/gyp2ht00c62827y0379lxh5dbx3hhho5
nvd.nist.gov/vuln/detail/CVE-2024-53299
wicket.apache.org/news/2025/01/31/wicket-8.17.0-released.html

Code Behaviors & Features

Detect and mitigate CVE-2024-53299 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →