Medium [CVE-2026-76985] Improper neutralization of input during web page generation in Apache Wicket
This medium-severity Apache Software Foundation advisory covers CVE-2026-76985 affecting Apache Wicket.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Apache Software Foundation publishes the next one.
VulniPulse checks Apache Software Foundation's security advisories around the clock and emails you new ones with the severity, the fixed version and the vendor's link. First month free, then US$15/month; we email you before the first charge.
Summary
Improper neutralization of input during web page generation in Apache Wicket.
org.apache.wicket.extensions.markup.html.form.palette.component. AbstractOptions, which renders the two option lists of a Palette, escapes the id and the display value of each option according to the escape-model-strings setting, and wrote the attribute names and values returned by getAdditionalAttributes into the tag as they came.
An application is affected where it overrides Palette.getAdditionalAttributesForChoices, Palette.getAdditionalAttributesForSelection or AbstractOptions.getAdditionalAttributes and returns a value holding data an attacker can influence. These methods return null by default, so an application that does not override them is not affected.
As a workaround, escape the values in the override.
This issue affects Apache Wicket: from 8.0.0 through 8.18.0, from 9.0.0 through 9.23.0, from 10.0.0 through 10.10.0. Older, unsupported releases from 1.4.0 onwards are also affected.
Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
- 8.0.0 through 8.18.0
- 9.0.0 through 9.23.0
- 10.0.0 through 10.10.0.
- through 10.10.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
- 8.19.0
- 9.24.0
- 10.11.0
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
Mitigation checklist
- Users are recommended to upgrade to version 8.19.0, 9.24.0 or 10.11.0, which fix the issue.
Official advisory · high-confidence parse· fetched 2 months ago·verify at source
More Apache Software Foundation advisories
- CVE-2026-76986Aug 31, 2026Apache Wicket cross-site scripting (XSS)
- CVE-2026-76983Aug 31, 2026Apache Wicket cross-site scripting (XSS)
- CVE-2026-76984Aug 31, 2026Apache Wicket cross-site scripting (XSS)
- CVE-2026-76982Aug 31, 2026Apache Wicket cross-site scripting (XSS)
- CVE-2026-75802Aug 31, 2026Apache Wicket: AjaxEditableChoiceLabel in wicket-extensions, when constructed
- CVE-2026-71378Aug 31, 2026Apache Wicket: ResourceIsolationRequestCycleListener protects a Wicket application against
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.