Advisories · Technology

Apache Software Foundation Apache Sling Engine.

Every CVE that names Apache Software Foundation Apache Sling Engine among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-103866 CVE record

Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
- Apache Software Foundation Apache Sling Engine
- HTTP request smuggling
- CWE-436
Not analysed yet 5 Nov 2026
CVE-2026-103864 CVE record

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
- Apache Software Foundation Apache Sling Engine
- Other injection
Not analysed yet 5 Nov 2026
CVE-2026-103863 CVE record

Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
- Apache Software Foundation Apache Sling Engine
- Cross-site scripting (XSS)
- CWE-693
Not analysed yet 5 Nov 2026