Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Sling Engine | < 3.0.4 | 3.0.4 |
Advisories 1
- WID-SEC-2026-4374 Apache Sling: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 5, 2026