CVE-2024-53299: Apache Wicket Memory Leak Vulnerability
Summary
CVE-2024-53299: Apache Wicket: An attacker can intentionally trigger a memory leak. Affects org.apache.wicket:wicket-core across 3 version ranges.
>= 7.0.0, < 8.17.0
>= 9.0.0-M1, < 9.19.0
>= 10.0.0, < 10.3.0
Fixed in 8.17.0, 9.19.0 or 10.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Wicket is a popular open-source web application framework for Java that simplifies the development of dynamic web applications. It provides a component-based architecture, allowing developers to create reusable UI components and manage their state effectively. However, versions prior to 9.19.0 and 10.3.0 are vulnerable to a critical memory leak issue that can be exploited by attackers, leading to denial of service (DOS) attacks.
Vulnerability Detail
The vulnerability arises from the request handling mechanism in Apache Wicket 7.0.0, which allows attackers to intentionally trigger a memory leak by sending multiple requests to server resources. This can overwhelm the server, leading to performance degradation or complete service unavailability. The issue is classified under CWE-400, which pertains to the 'Uncontrolled Resource Consumption' category, indicating that the application does not adequately limit resource usage, allowing attackers to exploit this weakness.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 8.17.08.17.0 -
>= 9.0.0-M1, < 9.19.09.19.0 -
>= 10.0.0, < 10.3.010.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement rate limiting on their server to mitigate the impact of potential DOS attacks. This can be done by configuring the web server or application server to limit the number of requests from a single IP address over a specified time period.
Conclusion
In summary, CVE-2024-53299 is a critical vulnerability in Apache Wicket that can lead to memory leaks and denial of service attacks. Users are strongly advised to upgrade to the patched versions to ensure the security and reliability of their applications. Additionally, implementing rate limiting can serve as a temporary measure to mitigate risks until the upgrade is completed.
See every vulnerability recorded for org.apache.wicket:wicket-core →
FAQ
CVE-2024-53299 is a vulnerability in Apache Wicket that allows attackers to trigger a memory leak, potentially leading to denial of service.
Apache Wicket versions prior to 9.19.0 and 10.3.0 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to a denial of service, causing the application to become unresponsive or crash due to excessive resource consumption.
Yes, upgrading to Apache Wicket versions 9.19.0 or 10.3.0 will patch the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.wicket:wicket-core.
