CVE-2026-103866
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Nov 05, 2026
Vendor
unknown
Description
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.