CVE-2026-103866
EUVD-2026-11743305.11.2026, 13:17
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.EnginsightEarly Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| apache | sling | 𝑥 < 3.0.4 | CNA |
Common Weakness Enumeration