Skip to content
OpenAdvisories
High · 7.5 CVE-2026-103864 EUVD-2026-117432GHSA-26c9-4vq3-99qm

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Published Nov 5, 2026 · Updated Nov 10, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Sling Engine

Description

Improper output neutralization for logs in Apache Sling Engine.

This issue affects Apache Sling Engine: before 3.0.4.

Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Sling Engine < 3.0.4 3.0.4

Advisories 1

References