Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Sling Engine

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-103866

    Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This i…

    Apache Software Foundation Apache Sling Engine
  • High 7.5
    CVE-2026-103864

    Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

    Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

    Apache Software Foundation Apache Sling Engine
  • High 8.0
    CVE-2022-45064

    Apache Sling Engine: Include-based XSS

    The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a reso…

    Apache Software Foundation Apache Sling Engine org.apache.sling:org.apache.sling.engine Maven