Apache Sling Engine before 3.0.4 vulnerable to HTTP request smuggling (CVE-2026-103866)
Apache Sling Engine before 3.0.4 allows HTTP request smuggling by accepting non-standard percent-escapes.
60
CVE-2026-103866
HTTP Request Smuggling in Apache Sling Engine before 3.0.4
- CVSS 3.1
- 7.5 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache Sling Engine's hand-rolled parameter parser accepts non-standard percent-escapes, wrong charsets, and continues processing on errors, diverging from RFC/container parsing. This enables HTTP Request/Response smuggling. An unauthenticated attacker can trigger it via crafted network HTTP requests. Affected are users of Apache Sling Engine before 3.0.4 who risk smuggling malicious requests that an attacker interprets.
What to do: Upgrade Apache Sling Engine to 3.0.4. No workaround provided.
| Product | Affected | Fixed in |
|---|---|---|
| Apache Sling Engine | before 3.0.4 | 3.0.4 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Weakness
- CWE-436, CWE-444
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N