Vulnerabilities

TI-2026-85399 CVE-2026-103866 · GHSA-fh7f-x3gj-j2vv

Apache Sling Engine parameter parser enables HTTP request smuggling

LOW 22

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.

CVSS — EPSS 0.00212 Published 2026-11-05 Fixed in 3.0.4 CWE-436

TI-2026-85398 CVE-2026-103864 · GHSA-26c9-4vq3-99qm

LOW 22

Improper output neutralization for logs in Apache Sling Engine.

CVSS — EPSS 0.00212 Published 2026-11-05 Fixed in 3.0.4 CWE-117

TI-2026-85397 CVE-2026-103863 · GHSA-64g6-vw43-hv3x

LOW 22

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.

CVSS — EPSS 0.00228 Published 2026-11-05 Fixed in 3.0.4 CWE-693