CVE-2026-103866

Description

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

References

https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3