CVE-2026-103866

UNKNOWN 0.0

Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

CWE	CWE-436 CWE-444
Vendor	apache software foundation
Product	apache sling engine
Published	Nov 5, 2026
Last Updated	Nov 5, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache sling engine

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache sling engine are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Sling Engine

0 < 3.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6 openwall.com: http://www.openwall.com/lists/oss-security/2026/11/05/8

Credits

The Apache Software Foundation Claude Code