Apache Wicket versions 9.14.0 through 9.24.0 and 10.0.0 through 10.9.1 have a vulnerability in the form-less file upload resource where upload size limits can be bypassed. The resource accepts upload size parameters from the client request without enforcing application-configured limits, allowing unbounded resource allocation. This can lead to excessive disk or memory consumption. The issue is fixed in versions 9.25.0 and 10.12.0.