CVE-2026-103864: Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization

Summary by Cyber Security News5 Nov 2026, 20:27 CET

About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/526

Posted by Joerg Hoh on Nov 05 Severity: low Affected versions: - Apache Sling Engine before 3.0.4 Description: Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Read the full article at oss-security →

Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

zlib 1.4 released with security fixes

Re: "sshole": password authentication bypass: OpenSSH + musl libc

CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling

CVE-2026-103863: Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

Re: GodotSteam 4.17 through 4.23.2: any multiplayer peer can claim the server's peer ID

[kubernetes] CVE-2026-116472: ingress-nginx mirror-target self-DOS