CVE-2026-92001: Apache Sling XSS: Missing parser resource limits

Apache Sling XSS, the bundle that sanitizes and filters markup in Apache Sling-based web applications, improperly restricts recursive entity references in DTDs (CWE-776) in all versions before 2.4.12. An attacker can submit content containing deeply nested XML entity references, which the XSS filter's parser expands without adequate resource limits; the related advisory headline also points to missing parser resource limits. Because the vector is scored AV:N/PR:N/UI:R with changed scope and low confidentiality and integrity impact, the practical result is a client-side attack (XSS-like behavior in a victim's browser) when a victim interacts with a page that renders the filtered content, rather than direct server compromise. Applications built on Apache Sling — including Adobe AEM-based deployments that ship the Sling XSS bundle — are affected if they run a version older than 2.4.12. No public proof of concept is known, the issue is not on CISA's KEV list, and there is no evidence of in-the-wild exploitation.