Apache Sling Engine before 3.0.4 vulnerable to HTTP request smuggling (CVE-2026-103866)
Original title: CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Apache Sling Engine before 3.0.4 allows HTTP request smuggling by accepting non-standard percent-escapes.
The Apache Sling Engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors, enabling HTTP Request/Response smuggling. Affects versions before 3.0.4. Users should upgrade.
- Allows non-standard percent-escapes
- Wrong charsets accepted
- Request processing continues on errors
- Enables HTTP Request/Response smuggling
- Upgrade to 3.0.4 recommended
Impact: HTTP request smuggling
- 1.Upgrade to Apache Sling Engine 3.0.4
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-103866 | HTTP Request Smuggling in Apache Sling Engine before 3.0.4 | 7.5 | — |
From the original article
Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3. 0. 4 Description: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.