Not rated
CVE-2021-23937 A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to…
Description
A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Wicket 9.2 | earliest → 9.2.0 | No fix stated |
| Apache Wicket 8.11 | earliest → 8.11.0 | No fix stated |
| Apache Wicket 7.17 | earliest → 7.17.0 | No fix stated |
| Apache Wicket 6.2 | 6.2.0 → latest | No fix stated |
Other CVEs of Apache Wicket
The 40 CVEs of Apache Wicket →
CVE-2026-111089
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
7.6
High
CVE-2026-95863
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
7.6
High
CVE-2026-87718
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
2.3
Low
CVE-2026-84231
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
7.4
High