org.apache.wicket:wicket-native-websocket-core vulnerabilities
CVEs whose affected-version data names the org.apache.wicket:wicket-native-websocket-core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-82559Low· 2.3Apache Wicket: WebSocket messages are processed against an HTTP session snapshot that survives invalidation
Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for th…
CVE-2026-82558Low· 2.3Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke
Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without …
CVE-2026-82115Medium· 6.3Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource
Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by t…