Apache Sling Security Bundle (Product): news timeline & CVEs

CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource

Low-severity vulnerability in Apache Sling Security Bundle where ContentDispositionFilter misses certain resource address shapes, fixed in v1.3.12.

A low-severity vulnerability, CVE-2026-94251, has been reported in the Apache Sling Security Bundle. The ContentDispositionFilter incorrectly mediates only one address/API shape of a resource, potentially leaving it unprotected. Users should upgrade to version 1.3.12 to fix the issue.

oss-securitySep 23, 15:50 UTC · 3d agoVulnerability 7 sources CVE-2026-94251

CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

Low-severity flaw in Apache Sling Security Bundle's RefererFilter accepting weak evidence, patched in version 1.3.2.

A low-severity vulnerability, CVE-2026-94243, has been disclosed in the Apache Sling Security Bundle. The RefererFilter accepts weaker-than-origin evidence, which could lead to security bypass. Users are advised to update to version 1.3.2 to remediate the issue.

oss-securitySep 23, 15:47 UTC · 3d agoVulnerability 7 sources CVE-2026-94243

Apache Sling Security Bundle

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource

CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence