CVE-2026-43646

CVE-2026-43646: Apache Wicket: crafted URLs can bypass PackageResourceGuard

Vendor Apache Software Foundation
Product Apache Wicket
Weakness CWE-200 · Info exposure
Published May 6, 2026
Last update May 6, 2026

CVSS base score

What the vulnerability does

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, from 9.0.0 through 9.22.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

Key dates

Disclosure timeline

May 6, 2026 CVE published
May 6, 2026 Record updated