Apache Wicket versions 9.14.0 through 9.24.0 and 10.0.0 through 10.11.0 contain a vulnerability in the FileUploadToResourceField component where memory allocation is performed based on untrusted client-supplied size values. This can lead to excessive heap memory consumption or unhandled exceptions. The issue is fixed in versions 9.25.0 and 10.12.0.