Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

Apache Sling Engine logs request-derived values without CR/LF neutralization (CVE-2026-103864)

Original title: CVE-2026-103864: Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

oss-security ()
Read at seclists.org
Part of a story covered by 3 sourcesApache Sling Engine <3.0.4 fixed for header bypass, logging, and smuggling issuesMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Apache Sling Engine before 3.0.4 does not neutralize CR/LF in logs for request-derived values.

Request-derived values reach log sinks without CR/LF neutralization in Apache Sling Engine before 3.0.4.

Key facts
  • No CR/LF neutralization in logs
  • Affects request-derived values
  • Before 3.0.4
  • Potential for XSS or similar
Security assessment · AI, from the articleNo known exploitation

Impact: XSS via logs or similar

What to do
  1. 1.Upgrade to Apache Sling Engine 3.0.4
Analyze CVE-2026-103864 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-103864
Tags
apacheslinglogging
Vendors
Apache
Products
Sling Engine

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-103864
Log injection in Apache Sling Engine before 3.0.4
7.5—

From the original article

Posted by Joerg Hoh on Nov 05 Severity: low https://sling. apache. org/...

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.