CVE-2026-82559 | Apache Wicket up to 8.19.0/9.24.0/10.11.0 WebSocket WebSocketSettings.java session expiration

November 2, 2026 Yanac

A vulnerability was found in Apache Wicket up to 8.19.0/9.24.0/10.11.0. It has been declared as critical. This impacts the function org.apache.wicket.protocol.ws.WebSocketSettings.newWebSocketRequest of the file org/apache/wicket/protocol/ws/WebSocketSettings.java of the component WebSocket. Such manipulation leads to session expiration.

This vulnerability is referenced as CVE-2026-82559. It is possible to launch the attack remotely. No exploit is available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More