Unrated severityNVD Advisory· Published Nov 5, 2026
CVE-2026-103866
CVE-2026-103866
Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Affected products
1- Range: <3.0.4
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.