CVE-2026-103866 | BDVDB-2026-400656 Detail

ApacheApache Sling Engine

Description#

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-436
CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')

References#

https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6
http://www.openwall.com/lists/oss-security/2026/11/05/8

Exploit#

No public exploit known

History#

Version 12026-11-05Record published in the CVE List.