Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence

oss-security ()2 · 1 read
Read at seclists.org
Part of a story covered by 7 sourcesSeven Apache Sling vulnerabilities disclosed via oss-security: five XSS-library CVEs fixed in 2.4.12 plus two low-severity Security Bundle flawsMerged summary & timeline
AI summary · glm-5.3Summaries by Vani AI

Low-severity flaw in Apache Sling Security Bundle's RefererFilter accepting weak evidence, patched in version 1.3.2.

A low-severity vulnerability, CVE-2026-94243, has been disclosed in the Apache Sling Security Bundle. The RefererFilter accepts weaker-than-origin evidence, which could lead to security bypass. Users are advised to update to version 1.3.2 to remediate the issue.

Key facts
  • Low-severity vulnerability in Apache Sling Security Bundle.
  • RefererFilter accepts weaker-than-origin evidence.
  • Patched in version 1.3.2.
Analyze CVE-2026-94243 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-94243
Tags
apache-slingcveopen-sourcereferer-filterweb-security
Vendors
Apache
Products
Apache Sling Security Bundle
Organizations
Apache Software FoundationClaude Code

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-94243
CSRF Protection Bypass in Apache Sling Security Bundle ReferrerFilter
7.3—

From the original article

Posted by Joerg Hoh on Sep 23 Severity: low Affected versions: - Apache Sling Security Bundle before 1. 3. 2 Description: A vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.