As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-103864: Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Apache Sling Engine versions before 3.0.4 fail to neutralize carriage return and line feed characters in request-derived values sent to log sinks, creating an improper output neutralization issue. The Apache Software Foundation rates the vulnerability as low severity and recommends upgrading to version 3.0.4 to remediate it.
Why it matters: Organizations running Apache Sling Engine before 3.0.4 should evaluate whether log injection through CR/LF characters poses a risk in their environment, particularly if logs are processed by downstream systems.
- Source published
- First seen by Cybersecurity Tracker