Vulnerabilitymedium
CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
AI summary · grok-4.7Summaries by Vani AI
Moderate Apache Sling XSS flaw CVE-2026-91852 covers raw-string break-outs and ReDoS in XSSImpl.
Joerg Hoh posted an oss-security note on CVE-2026-91852 affecting Apache Sling XSS, rated moderate. The flaw is CWE-79 cross-site scripting through multiple raw-string break-outs in XSSImpl, together with regular-expression denial of service. It is tracked as SLING-13334. The short advisory does not give affected versions or say exploitation has been observed.
Key facts
- CVE-2026-91852 is rated moderate
- CWE-79 raw-string break-outs in XSSImpl
- Issue also includes ReDoS
- Tracked in Apache Jira as SLING-13334
- CVEs
- CVE-2026-91852
- Vendors
- Apache Software Foundation
- Products
- Apache Sling XSS
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91852 | Cross-Site Scripting Filter Bypass in Apache Sling XSS before 2.4.12 | 6.1 | — |
From the original article
Posted by Joerg Hoh on Sep 23 Severity: moderate https://issues. apache. org/jira/browse/SLING-13334 Credit: Apache...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.