{"id":"CVE-2026-103866","kind":"vulnerability","aliases":["CVE-2026-103866"],"related":[],"title":"Apache Sling Engine: request parser flaw enables HTTP request smuggling","description":"Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","summary":"Apache Sling Engine's query and form parser accepts non-standard percent-escapes and wrong charsets, and keeps processing requests after such parse errors. This lets an attacker craft requests that a front-end proxy and Sling read differently, which can smuggle a second request past access controls.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aem","apache-sling","java","package"],"not_affected_if":["already-patched"],"how_to_check":"- Check the Apache Sling Engine version in the project's dependency file or bundle manifest, looking for versions before `3.0.4`\n- Confirm whether a reverse proxy or load balancer sits in front of the Sling-based application","fix":"- Apache Sling Engine: upgrade to `3.0.4`","status":"open","published_at":"2026-11-05T13:17:07+00:00","first_seen_at":"2026-11-05T13:39:09+00:00","triaged_at":"2026-11-05T13:40:09+00:00","updated_at":"2026-11-05T13:40:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T13:40:09Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Sling Engine: upgrade to `3.0.4`","reach":"network","title":"Apache Sling Engine: request parser flaw enables HTTP request smuggling","impact":"medium","summary":"Apache Sling Engine's query and form parser accepts non-standard percent-escapes and wrong charsets, and keeps processing requests after such parse errors. This lets an attacker craft requests that a front-end proxy and Sling read differently, which can smuggle a second request past access controls.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-sling","java","aem"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker smuggles requests past proxy controls into the application","analyst_note":"Confirm exploit preconditions and whether a proxy in front is required, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-103866 and the Apache Sling security page.","how_to_check":"- Check the Apache Sling Engine version in the project's dependency file or bundle manifest, looking for versions before `3.0.4`\n- Confirm whether a reverse proxy or load balancer sits in front of the Sling-based application","plain_action":"","needs_analyst":true,"not_affected_if":["already-patched"],"who_is_affected":"Applications built on Apache Sling Engine before 3.0.4 are exposed, most of all those behind a proxy or load balancer that parses requests differently. Systems not running Sling, or already on 3.0.4 or later, can skip it. The sources do not describe the exact exploit conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000727,"input_tokens":4271,"output_tokens":599,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-103866':13A,16A '-2026':12A,15A '3.0.4':115C,123C 'accept':31B,92C 'access':72B 'aem':17B 'affect':110C 'apach':1A,19B,23B,84C,111C 'apache-sl':18B 'attack':52B 'charset':40B,100C 'continu':102C 'control':73B 'craft':53B 'cve':11A,14A 'differ':64B 'enabl':7A 'end':59B 'engin':3A,25B,86C,88C,113C 'error':48B,107C 'escap':37B,98C 'fix':125C 'flaw':6A 'form':29B 'front':58B 'front-end':57B 'http':8A,77C,79C 'inconsist':74C 'interpret':75C 'issu':109C,127C 'java':21B 'keep':42B 'let':50B 'non':33B,94C 'non-standard':32B,93C 'packag':22B 'pars':47B 'parser':5A,30B,91C 'past':71B 'percent':36B,97C 'percent-escap':35B,96C 'process':43B,104C 'proxi':60B 'queri':27B 'query/form':90C 'read':63B 'recommend':118C 'request':4A,9A,44B,54B,70B,78C,103C 'request/response':80C 'second':69B 'sling':2A,20B,24B,62B,85C,112C 'smuggl':10A,67B,81C 'standard':34B,95C 'upgrad':120C 'user':116C 'version':122C 'vulner':82C 'wrong':39B,99C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Sling Engine before 3.0.4 are exposed, most of all those behind a proxy or load balancer that parses requests differently. Systems not running Sling, or already on 3.0.4 or later, can skip it. The sources do not describe the exact exploit conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aem","apachesling","java","package","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T13:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103866","severity":null,"published_at":"2026-11-05T13:17:07+00:00","modified_at":"2026-11-05T13:17:07+00:00","first_seen_at":"2026-11-05T13:39:09+00:00","fetched_at":"2026-11-05T13:39:09+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}