BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-103866Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

EPSS 0.21%Not in KEVNVD: Received

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

No CVSS score has been published for CVE-2026-103866 yet.

Details

CVE ID
CVE-2026-103866
Status
Received
Assigner (CNA)
apache
Published
Nov 5, 2026
Last modified
2026-11-05 22:17 UTC
Weaknesses
  • CWE-436
  • CWE-444 · Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:28 UTC.