Skip to content
fr Sign in
Not rated

CVE-2021-23937 A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to…

Description

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.

Affected products and versions

Product Affected versions Fixed in
Apache Wicket 9.2 earliest → 9.2.0 No fix stated
Apache Wicket 8.11 earliest → 8.11.0 No fix stated
Apache Wicket 7.17 earliest → 7.17.0 No fix stated
Apache Wicket 6.2 6.2.0 → latest No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Wicket

The 40 CVEs of Apache Wicket →
CVE-2026-111089 Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes… 7.6 High CVE-2026-95863 Improper neutralization of input during web page generation in Apache Wicket 7.6 High CVE-2026-87718 Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render… 2.3 Low CVE-2026-84231 Improper neutralization of input during web page generation in Apache Wicket 7.4 High
Track this CVE