CVE-2026-103863

UNKNOWN 0.0

Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

CWE	CWE-79 CWE-693
Vendor	apache software foundation
Product	apache sling engine
Published	Nov 5, 2026
Last Updated	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache sling engine

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache sling engine are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Sling Engine

0 < 3.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg openwall.com: http://www.openwall.com/lists/oss-security/2026/11/05/6

Credits

The Apache Software Foundation Claude Code