Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitylow

Apache Sling Engine <3.0.4 fixed for header bypass, logging, and smuggling issues

1 source · 3 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Apache Sling Engine before 3.0.4 had three vulnerabilities fixed in 3.0.4 allowing header evasion, unneutralized logs, and request smuggling.

Apache Sling Engine versions before 3.0.4 contain multiple security flaws. Content-Type, charset, and redirect changes from included components can bypass header protections. Request-derived values reach log sinks without CR/LF neutralization, and a custom parser accepts non-standard percent-escapes while continuing processing, enabling HTTP request smuggling. All issues are resolved in version 3.0.4.

Key facts
  • CVE-2026-103863: Header mitigations bypassable via response wrappers in Sling Engine <3.0.4
  • CVE-2026-103864: Request values logged without CR/LF neutralization in Sling Engine before 3.0.4
  • CVE-2026-103866: Non-standard percent-escapes enable HTTP smuggling in Sling Engine <3.0.4
  • Fixed in Apache Sling Engine 3.0.4
  • Potential impacts include XSS and request/response smuggling
Analyze CVE-2026-103866 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 5, 2026OSS Security discloses three CVEs in Apache Sling Engine · oss-security
CVEs
CVE-2026-103866CVE-2026-103864CVE-2026-103863
Vendors
Apache
Products
Sling Engine

Coverage

oldest first · one row per article · UTC
  1. · 6d ago oss-securityFirst report

    Apache Sling Engine CVE-2026-103863 bypasses include-protection mitigations

    Content-Type, charset, and redirect changes from included components evade header enforcement in Sling Engine before 3.0.4.

  2. · 6d ago oss-security

    Apache Sling Engine logs request-derived values without CR/LF neutralization (CVE-2026-103864)

    Apache Sling Engine before 3.0.4 does not neutralize CR/LF in logs for request-derived values.

  3. · 6d ago oss-security

    Apache Sling Engine before 3.0.4 vulnerable to HTTP request smuggling (CVE-2026-103866)

    Apache Sling Engine before 3.0.4 allows HTTP request smuggling by accepting non-standard percent-escapes.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-103864
+2 related CVEs
CVE-2026-103866CVE-2026-103863
Log injection in Apache Sling Engine before 3.0.4
7.5
group max
—