Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-87718— Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates

Quick assessment

Affected
Apache Software Foundation Apache Wicket
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Wicket 10.10.0、10.11.0 和 9.24.0 存在一个安全漏洞：当页面的渲染请求处理器被多个 嵌套包装时，框架不会为该页面设置 （CSP，内容安全策略）响应头。 该框架在判断某个请求是否用于渲染页面时，仅会解包一层委托（delegate）。因此，在存在更深层嵌套委托链的情况下（例如：应用程序自定义的委托式请求映射器与 组合使用），即使已启用 CSP 功能，页面仍会在未携带任何 CSP 头的情况下被返回，且不会触发任何错误或警告。 这导致 Wicket 原本应用于内联脚本和样式的基于

CVSS 2.3 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87718

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Wicket: CSP headers silently omitted for pages served through nested request handler delegates
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Users are recommended to upgrade to version 10.12.0 or 9.25.0, which fix the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/AU:N/RE:L
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Wicket 9.24.0 -

II. Public POCs for CVE-2026-87718

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87718

请登录查看更多情报信息。

Other References for CVE-2026-87718 (1)

Same Patch Batch · Apache Software Foundation · 2026-11-01 · 19 CVEs total

CVE-2026-83594 8.3 HIGH Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and alloc
CVE-2026-84170 8.3 HIGH Apache Wicket: Configured upload limits are not enforced by the standalone file upload res
CVE-2026-95863 7.6 HIGH Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaSc
CVE-2026-82956 7.6 HIGH Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
CVE-2026-111089 7.6 HIGH Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript
CVE-2026-84231 7.4 HIGH Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-
CVE-2026-83559 7.4 HIGH Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output c
CVE-2026-83539 7.4 HIGH Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in
CVE-2026-82840 7.2 HIGH Apache Wicket: The session id is renewed only on the first sign in, not on re-authenticati
CVE-2026-82704 6.9 MEDIUM Apache Wicket: A listener is invoked on a page instance the request itself created and nev
CVE-2026-82557 6.9 MEDIUM Apache Wicket: A disabled or invisible form submitting component is still invoked on a pla
CVE-2026-84172 6.3 MEDIUM Apache Wicket: Component markup is served as a package resource when wicket-core has its o
CVE-2026-84177 6.3 MEDIUM Apache Wicket: A component's markup is served as a package resource when its class name co
CVE-2026-82705 6.3 MEDIUM Apache Wicket: The configured authorization strategy is not applied to an IResource embedd
CVE-2026-82115 6.3 MEDIUM Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketR
CVE-2026-82559 2.3 LOW Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that surv
CVE-2026-82558 2.3 LOW Apache Wicket: WebSocketBehavior delivers client messages to a component the client may no
CVE-2026-82898 2.1 LOW Apache Wicket: A cross-origin listener invocation stopped by a login wall is replayed afte

IV. Related Vulnerabilities

Same product: Apache Wicket
Same vendor: Apache Software Foundation
Same weakness: CWE-693