Apache Sling Engine logs request-derived values without CR/LF neutralization (CVE-2026-103864)
Apache Sling Engine before 3.0.4 does not neutralize CR/LF in logs for request-derived values.
55
Vulnerability1 · 1 read
CVE-2026-103864
Log injection in Apache Sling Engine before 3.0.4
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Improper output neutralization for logs in Apache Sling Engine lets request-derived values reach log sinks without CR/LF neutralization. This enables log injection attacks where attackers append arbitrary entries. Triggered via network requests. Affected users of Apache Sling Engine before 3.0.4 gain ability to manipulate logs.
What to do: Upgrade to Apache Sling Engine 3.0.4. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Sling Engine | before 3.0.4 | 3.0.4 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Weakness
- CWE-117
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N