High · 7.5 CVE-2023-26513 EUVD-2023-1104GHSA-rwrx-x2hw-9h5w

Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS

Published Mar 20, 2023 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Sling Resource Merger Package: org.apache.sling:org.apache.sling.resourcemerger Ecosystem: Maven

Description

Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Sling Resource Merger	1.2.0 – < 1.4.2	1.4.2

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.apache.sling:org.apache.sling.resourcemerger	>= 1.2.0, < 1.4.2	1.4.2	GHSA-rwrx-x2hw-9h5w

Advisories 1

WID-SEC-2023-0698 Apache Sling: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Mar 20, 2023

References

https://lists.apache.org/thread/xpcpo1y88ldss5hgmvogsf6h3735l5zb vendor-advisory

CNA	v3.1	7.5
EUVD	v3.1	7.5
OSV:GHSA	v3.1	7.5