CVE-2026-103864

UNKNOWN 0.0

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

CWE	CWE-117
Vendor	apache software foundation
Product	apache sling engine
Published	Nov 5, 2026
Last Updated	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache sling engine

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache sling engine are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Sling Engine

0 < 3.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/05/7

Credits

The Apache Software Foundation Claude Code