CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

Apache Sling XSS, the anti-XSS filtering library used by Sling-based Java applications (including Adobe Experience Manager), contains an improper input neutralization flaw (CWE-79) in XSSImpl prior to version 2.4.12. The flaw includes multiple 'raw-string break-outs', meaning attacker-controlled content can escape the library's sanitization, plus a regular-expression denial-of-service (ReDoS) issue in the same component. When an application uses the library to filter untrusted input that is later rendered in a generated web page, an attacker who can get crafted content stored or reflected and viewed by a victim can execute script in the victim's browser, potentially hijacking their session or performing actions on their behalf. The ReDoS component can additionally be triggered to hang processing threads with pathological input. The fix is upgrading to Apache Sling XSS 2.4.12; there is no known public proof of concept and no evidence of exploitation in the wild.