Skip to content
OpenAdvisories
Medium WID-SEC-2026-4374 3 CVEs

Apache Sling: Mehrere Schwachstellen

Published Nov 5, 2026 · Updated Nov 5, 2026 · de-DE

Vendor: Apache Product: Sling Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Apache Sling ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder nicht näher spezifizierte Auswirkungen zu verursachen.

Product

Apache Sling ist ein Open Source-Webframework für die Java-Plattform.

Vulnerabilities 3

  • High 7.5
    CVE-2026-103864

    Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

    Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

    Apache Software Foundation Apache Sling Engine
  • High 7.5
    CVE-2026-103866

    Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This i…

    Apache Software Foundation Apache Sling Engine
  • Medium 5.4
    CVE-2026-103863

    Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through…

    Apache Software Foundation Apache Sling Engine

Revision history

  1. #1

    Initiale Fassung

References