CVE-2026-103864Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

EPSS 0.21%Not in KEVNVD: Received

Last updated: 2026-11-05 22:17 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-103864 yet.

Details

CVE ID: CVE-2026-103864
Status: Received
Assigner (CNA): apache
Published: Nov 5, 2026
Last modified: 2026-11-05 22:17 UTC
Weaknesses: CWE-117 · Improper output neutralization for logs

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:27 UTC.