CVE-2026-87718 Details
Description
Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Users are recommended to upgrade to version 10.12.0 or 9.25.0, which fix the issue.
A vulnerability exists in Apache Wicket versions 10.10.0, 10.11.0, and 9.24.0, where Content-Security-Policy (CSP) headers are not applied to pages rendered through multiple nested IRequestHandlerDelegates. This issue arises because the framework only unwraps one delegate level when determining if a request should render a page. As a result, pages served through deeper delegate chains—such as those created by application-provided request mappers combined with CryptoMapper—are delivered without the appropriate CSP headers, despite CSP being enabled. This omission removes the nonce-based protection Wicket provides for inline scripts and styles, along with any other CSP directives set by the application, leaving those pages vulnerable to content injection. Applications using standard Wicket that do not create their own request handler wrappers are not impacted. Versions prior to 10.10.0 and 9.24.0 correctly managed nested delegates.
Users are advised to upgrade to Apache Wicket versions 10.12.0 or 9.25.0, which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread.html/fjq8v35zpkbtjwpzwkkpzocwtdgokp1m | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Wicket | 9.24.0 (semver) 10.10.0 (semver) 10.11.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | [email protected] |