Seven Apache Sling vulnerabilities disclosed via oss-security: five XSS-library CVEs fixed in 2.4.12 plus two low-severity Security Bundle flaws

On 2026-09-23 oss-security carried seven Apache Sling advisories: five CVEs in the Sling XSS library (three moderate, two low), four of them explicitly fixed in version 2.4.12, and two low-severity flaws in the Sling Security Bundle fixed in 1.3.2 and 1.3.12;…

Seven vulnerability disclosures for two Apache Sling components were posted to oss-security on 2026-09-23. The Apache Sling XSS library accounts for five CVEs: (1) CVE-2026-91852 (SLING-13334, moderate) — CWE-79 cross-site scripting via multiple raw-string break-outs in XSSImpl, combined with a regular-expression denial of service (ReDoS) condition; this short advisory lists no affected versions and does not state that exploitation has been observed. (2) CVE-2026-91928 (SLING-13333, moderate) — improper neutralization of input during web page generation in Apache Sling XSS before 2.4.12, described as a sanitizer bypass with uncontrolled resource consumption and failure of protection mechanisms; fixed in 2.4.12, no exploitation reported. (3) CVE-2026-91999 (SLING-13335, low) — improper escaping in the XSS Webconsole plugin allowing cross-site scripting in versions before 2.4.12; fixed in 2.4.12, no exploitation reported. (4) CVE-2026-92001 (SLING-13336, moderate) — XML entity expansion, i.e., improper restriction of recursive entity references in DTDs due to missing parser resource limits, in Apache Sling XSS before 2.4.12; patched in 2.4.12 and credited to discovery by the Apache Software Foundation. (5) CVE-2026-73192 (low) — reflected cross-site scripting enabling script injection through the XSSAPI.getValidHref() method; patched in version 2.4.12. Separately, the Apache Sling Security Bundle has two low-severity flaws: CVE-2026-94243, in which the RefererFilter accepts weaker-than-origin evidence and could lead to security bypass, fixed in version 1.3.2, and CVE-2026-94251, in which the ContentDispositionFilter mediates only one address/API shape of a resource, potentially leaving other resource address shapes unprotected, fixed in version 1.3.12. The reports do not contradict one another; the only gap is that the CVE-2026-91852 advisory omits affected-version information, whereas the other four XSS advisories uniformly specify versions before 2.4.12 as affected. Remediation across the set requires upgrading Sling XSS to 2.4.12 and the Sling Security Bundle to 1.3.2 for CVE-2026-94243 and 1.3.12 for CVE-2026-94251.