HTTP Request/Response Smuggling Vulnerability in Apache Sling Engine
CVE-2026-103866

Currently unrated

Key Information:

Vendor: Apache
Status: Apache Sling Engine
Vendor: CVE Published:; 5 November 2026

What is CVE-2026-103866?

An HTTP Request/Response smuggling vulnerability exists in Apache Sling Engine due to inconsistent handling of HTTP requests. The engine's query/form parser incorrectly processes non-standard percent-escapes and character sets, leading to potential issues with request processing. This behavior can allow attackers to exploit the vulnerability by sending specially crafted HTTP requests. Users are advised to upgrade to version 3.0.4 to resolve this issue and enhance security.

Affected Version(s)

Apache Sling Engine 0 < 3.0.4

References

https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj...

vendor-advisory

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 5, 2026
Vulnerability Reserved
Oct 1, 2026

Credit

The Apache Software Foundation

Claude Code

CVE-2026-103866 Data

JSON