As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Apache Sling Engine before version 3.0.4 contains an HTTP request smuggling vulnerability due to its query and form parser accepting non-standard percent-escapes, incorrect charsets, and continuing processing despite errors. The parser's behavior diverges from RFC standards and container parsing specifications, creating a potential smuggling attack surface. The vendor recommends upgrading to patch the issue.
Why it matters: Organizations running Apache Sling Engine before 3.0.4 face HTTP request smuggling risks that could enable cache poisoning or request interception; practitioners should prioritize upgrading to version 3.0.4 or later.
- Source published
- First seen by Cybersecurity Tracker