Search

Find a vulnerability

Search criteria

    8 vulnerabilities found for Apache Sling Engine by Apache Software Foundation

    CVE-2026-103866 (GCVE-0-2026-103866)

    Vulnerability from nvd – Published: 2026-11-05 12:33 – Updated: 2026-11-05 12:33
    VLAI
    Title
    Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
    Summary
    Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
    Severity
    No CVSS data available.
    CWE
    • CWE-436
    • CWE-444 - Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Credits
    The Apache Software Foundation Claude Code
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Software Foundation"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Code"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027) vulnerability in Apache Sling Engine.\u0026nbsp;The engine\u0027s query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling Engine: before 3.0.4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.0.4, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027) vulnerability in Apache Sling Engine.\u00a0The engine\u0027s query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T12:33:00.994Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6"
        }
      ],
      "source": {
        "defect": [
          "SLING-13362",
          "SLING-13364",
          "SLING-13365"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-103866",
    "datePublished": "2026-11-05T12:33:00.994Z",
    "dateReserved": "2026-10-01T11:47:21.504Z",
    "dateUpdated": "2026-11-05T12:33:00.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103864 (GCVE-0-2026-103864)

    Vulnerability from nvd – Published: 2026-11-05 12:32 – Updated: 2026-11-05 12:32
    VLAI
    Title
    Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
    Summary
    Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
    Severity
    No CVSS data available.
    CWE
    • CWE-117 - Improper output neutralization for logs
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Credits
    The Apache Software Foundation Claude Code
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Software Foundation"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Code"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper output neutralization for logs in Apache Sling Engine.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling Engine: before 3.0.4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.0.4, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117 Improper output neutralization for logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T12:32:26.166Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"
        }
      ],
      "source": {
        "defect": [
          "SLING-13360",
          "SLING-13361"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-103864",
    "datePublished": "2026-11-05T12:32:26.166Z",
    "dateReserved": "2026-10-01T11:45:18.469Z",
    "dateUpdated": "2026-11-05T12:32:26.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103863 (GCVE-0-2026-103863)

    Vulnerability from nvd – Published: 2026-11-05 12:31 – Updated: 2026-11-05 12:31
    VLAI
    Title
    Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
    Summary
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
    Severity
    No CVSS data available.
    CWE
    • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
    • CWE-693
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Credits
    The Apache Software Foundation Claude Code
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Software Foundation"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Code"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling Engine.\u0026nbsp;Content-Type, charset, and redirect changes from an included component evade the \u0026nbsp;protectheaders\u0026nbsp;/\u0026nbsp;checkcontenttype\u0026nbsp; enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling Engine before 3.0.4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.0.4, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling Engine.\u00a0Content-Type, charset, and redirect changes from an included component evade the \u00a0protectheaders\u00a0/\u00a0checkcontenttype\u00a0 enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T12:31:45.446Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"
        }
      ],
      "source": {
        "defect": [
          "SLING-13345",
          "SLING-13350",
          "SLING-13351",
          "SLING-13352",
          "SLING-13357"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-103863",
    "datePublished": "2026-11-05T12:31:45.446Z",
    "dateReserved": "2026-10-01T11:44:49.432Z",
    "dateUpdated": "2026-11-05T12:31:45.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-45064 (GCVE-0-2022-45064)

    Vulnerability from nvd – Published: 2023-04-13 10:01 – Updated: 2024-10-17 20:31
    VLAI
    Title
    Apache Sling Engine: Include-based XSS
    Summary
    The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power. Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.
    Severity
    8 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-10-17 20:29 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Apache Software Foundation Apache Sling Engine Affected: , < 2.14.0 (semver)
    		Create a notification for this product.
    apache sling Affected: 0 , < 2.14.0 (custom)
        cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Lars Krapf
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:01:31.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/04/18/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sling",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "2.14.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-45064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T20:29:41.550462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-17T20:31:19.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.14.0",
              "status": "affected",
              "version": " ",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Lars Krapf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe SlingRequestDispatcher doesn\u0027t correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003ePlease update to Apache Sling Engine \u0026gt;= 2.14.0 and enable the \"Check Content-Type overrides\" configuration option.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "The SlingRequestDispatcher doesn\u0027t correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.\n\n\n\n\nPlease update to Apache Sling Engine \u003e= 2.14.0 and enable the \"Check Content-Type overrides\" configuration option.\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-13T10:01:14.502Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/04/18/6"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Include-based XSS",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-45064",
    "datePublished": "2023-04-13T10:01:14.502Z",
    "dateReserved": "2022-11-09T09:29:43.945Z",
    "dateUpdated": "2024-10-17T20:31:19.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2026-103866 (GCVE-0-2026-103866)

    Vulnerability from cvelistv5 – Published: 2026-11-05 12:33 – Updated: 2026-11-05 12:33
    VLAI
    Title
    Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
    Summary
    Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
    Severity
    No CVSS data available.
    CWE
    • CWE-436
    • CWE-444 - Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Credits
    The Apache Software Foundation Claude Code
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Software Foundation"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Code"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027) vulnerability in Apache Sling Engine.\u0026nbsp;The engine\u0027s query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling Engine: before 3.0.4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.0.4, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027) vulnerability in Apache Sling Engine.\u00a0The engine\u0027s query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444 Inconsistent interpretation of HTTP requests (\u0027HTTP Request/Response smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T12:33:00.994Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6"
        }
      ],
      "source": {
        "defect": [
          "SLING-13362",
          "SLING-13364",
          "SLING-13365"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-103866",
    "datePublished": "2026-11-05T12:33:00.994Z",
    "dateReserved": "2026-10-01T11:47:21.504Z",
    "dateUpdated": "2026-11-05T12:33:00.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103864 (GCVE-0-2026-103864)

    Vulnerability from cvelistv5 – Published: 2026-11-05 12:32 – Updated: 2026-11-05 12:32
    VLAI
    Title
    Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
    Summary
    Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
    Severity
    No CVSS data available.
    CWE
    • CWE-117 - Improper output neutralization for logs
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Credits
    The Apache Software Foundation Claude Code
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Software Foundation"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Code"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper output neutralization for logs in Apache Sling Engine.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling Engine: before 3.0.4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.0.4, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117 Improper output neutralization for logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T12:32:26.166Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"
        }
      ],
      "source": {
        "defect": [
          "SLING-13360",
          "SLING-13361"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-103864",
    "datePublished": "2026-11-05T12:32:26.166Z",
    "dateReserved": "2026-10-01T11:45:18.469Z",
    "dateUpdated": "2026-11-05T12:32:26.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-103863 (GCVE-0-2026-103863)

    Vulnerability from cvelistv5 – Published: 2026-11-05 12:31 – Updated: 2026-11-05 12:31
    VLAI
    Title
    Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
    Summary
    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
    Severity
    No CVSS data available.
    CWE
    • CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
    • CWE-693
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Credits
    The Apache Software Foundation Claude Code
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "The Apache Software Foundation"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Claude Code"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling Engine.\u0026nbsp;Content-Type, charset, and redirect changes from an included component evade the \u0026nbsp;protectheaders\u0026nbsp;/\u0026nbsp;checkcontenttype\u0026nbsp; enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Sling Engine before 3.0.4.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.0.4, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Sling Engine.\u00a0Content-Type, charset, and redirect changes from an included component evade the \u00a0protectheaders\u00a0/\u00a0checkcontenttype\u00a0 enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-693",
              "description": "CWE-693",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T12:31:45.446Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"
        }
      ],
      "source": {
        "defect": [
          "SLING-13345",
          "SLING-13350",
          "SLING-13351",
          "SLING-13352",
          "SLING-13357"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-103863",
    "datePublished": "2026-11-05T12:31:45.446Z",
    "dateReserved": "2026-10-01T11:44:49.432Z",
    "dateUpdated": "2026-11-05T12:31:45.446Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2022-45064 (GCVE-0-2022-45064)

    Vulnerability from cvelistv5 – Published: 2023-04-13 10:01 – Updated: 2024-10-17 20:31
    VLAI
    Title
    Apache Sling Engine: Include-based XSS
    Summary
    The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power. Please update to Apache Sling Engine >= 2.14.0 and enable the "Check Content-Type overrides" configuration option.
    Severity
    8 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2024-10-17 20:29 UTC
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    apache CNA under the mitre root
    CNA scorecard B 76/100 over 1170 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    Apache Software Foundation Apache Sling Engine Affected: , < 2.14.0 (semver)
    		Create a notification for this product.
    apache sling Affected: 0 , < 2.14.0 (custom)
        cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*
    		Create a notification for this product.
    Credits
    Lars Krapf
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T14:01:31.530Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/04/18/6"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:sling:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sling",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "2.14.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-45064",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-17T20:29:41.550462Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-17T20:31:19.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Sling Engine",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.14.0",
              "status": "affected",
              "version": " ",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Lars Krapf"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cdiv\u003eThe SlingRequestDispatcher doesn\u0027t correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003ePlease update to Apache Sling Engine \u0026gt;= 2.14.0 and enable the \"Check Content-Type overrides\" configuration option.\u003cbr\u003e\u003cbr\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "The SlingRequestDispatcher doesn\u0027t correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.\n\n\n\n\nPlease update to Apache Sling Engine \u003e= 2.14.0 and enable the \"Check Content-Type overrides\" configuration option.\n\n\n\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-04-13T10:01:14.502Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/hhp611hltby3whk03vx2mv7cmy3vs0ok"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2023/04/18/6"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Sling Engine: Include-based XSS",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-45064",
    "datePublished": "2023-04-13T10:01:14.502Z",
    "dateReserved": "2022-11-09T09:29:43.945Z",
    "dateUpdated": "2024-10-17T20:31:19.485Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}