CVE-2026-103866 · Package
NO FIX YET · SEE WHAT TO DO
Apache Sling Engine's query and form parser accepts non-standard percent-escapes and wrong charsets, and keeps processing requests after such parse errors. This lets an attacker craft requests that a front-end proxy and Sling read differently, which can smuggle a second request past access controls.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications built on Apache Sling Engine before 3.0.4 are exposed, most of all those behind a proxy or load balancer that parses requests differently. Systems not running Sling, or already on 3.0.4 or later, can skip it. The sources do not describe the exact exploit conditions.
Not affected if already-patched
Who cares aem, apache-sling, java
3.0.43.0.4Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.