Apache Sling Engine vulnerabilities

3 known vulnerabilities in Apache Sling Engine from Apache. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Sling Engine: Interpretation Conflict

  CVE-2026-103866Nov 5, 2026Apache

  Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This is

• 7.5 High severity

  Apache Sling Engine: Improper Output Neutralization for Logs

  CVE-2026-103864Nov 5, 2026Apache

  Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.

• 9.0 Critical severity

  Apache Sling Engine: Improper Neutralization of Input During Web Page Generation

  CVE-2022-45064Apr 13, 2023ApacheEPSS 1.12%

  The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resou