Skip to content
OpenAdvisories
High WID-SEC-2026-3526 7 CVEs

Apache Sling: Mehrere Schwachstellen

Published Sep 22, 2026 · Updated Sep 23, 2026 · Revision 2 · de-DE

Vendor: Apache Product: Sling Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Sling ausnutzen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

Apache Sling ist ein Open Source-Webframework für die Java-Plattform.

Vulnerabilities 7

  • High 7.3
    CVE-2026-94243

    Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

    A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security Bundle: before 1.3.2. Users are recommended to upgrade to version 1.3.2, which fixes the issue.

    Apache Software Foundation Apache Sling Security Bundle
  • Medium 6.5
    CVE-2026-94251

    Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource

    A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource This issue affects Apache Sling Security Bundle: before 1.3.12. Users are recommended to upgrade to version 1.3.12, which fixes the iss…

    Apache Software Foundation Apache Sling Security Bundle
  • Medium 6.1
    CVE-2026-73192

    Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

    An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting …

    Apache Software Foundation Apache Sling XSS
  • Medium 6.1
    CVE-2026-91852

    Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

    Apache Software Foundation Apache Sling XSS
  • Medium 6.1
    CVE-2026-91928

    Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

    Apache Software Foundation Apache Sling XSS
  • Medium 6.1
    CVE-2026-91999

    Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

    Apache Software Foundation Apache Sling XSS
  • Medium 6.1
    CVE-2026-92001

    Apache Sling XSS: Missing parser resource limits

    Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

    Apache Software Foundation Apache Sling XSS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-85182, EUVD-2026-85180, EUVD-2026-85179

  2. #1

    Initiale Fassung

References