CVE-2026-92001: Apache Sling XSS: Missing parser resource limits
Apache Sling XSS before 2.4.12 has an XML entity expansion vulnerability (CVE-2026-92001).
Apache Sling XSS before version 2.4.12 contains a vulnerability (CVE-2026-92001) allowing improper restriction of recursive entity references in DTDs, also known as XML entity expansion. The flaw is tracked as SLING-13336 and was discovered by the Apache Software Foundation. The vendor has released a patch in version 2.4.12 to address the issue.
- Apache Sling XSS before 2.4.12 has an XML entity expansion vulnerability.
- The flaw is tracked as SLING-13336 and is rated moderate.
- Users are advised to upgrade to version 2.4.12 to fix the issue.
- CVEs
- CVE-2026-92001
- Vendors
- Apache
- Products
- Apache Sling XSSToyota Corolla
- Threat actors
- Ryuk
- Victims
- Universal Health Services
- AI models
- GPT-6 Astra
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-92001 | XML Entity Expansion Flaw in Apache Sling XSS Library Before 2.4.12 | 6.1 | — |
From the original article
Posted by Joerg Hoh on Sep 23 Severity: moderate Affected versions: - Apache Sling XSS before 2. 4. 12 Description: Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.