CVE-2026-42509

CVE-2026-42509: Apache Wicket: crafted strings can break out of the JavaScript sequence

Vendor Apache Software Foundation
Product Apache Wicket
Weakness CWE-79 · XSS
Published May 6, 2026
Last update May 7, 2026
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Key dates

Disclosure timeline

May 6, 2026 CVE published
May 7, 2026 Record updated