CVE-2026-103863
Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Exploit likelihood
What each source reports
CVE List No score
Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
CVE-2026-103863- Weakness
- CWE-79, CWE-693
- Updated
- 2026-11-05
EUVDEUVD-2026-117431 No score
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
EUVD-2026-117431- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-64g6-vw43-hv3x No score
Improper neutralization of input during web page generation ('cross-site scripting')...
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
GHSA-64g6-vw43-hv3x- Weakness
- CWE-79
- Updated
- 2026-11-06
NVD No score
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.
This issue affects Apache Sling Engine before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
CVE-2026-103863- Weakness
- CWE-79, CWE-693
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103863 is a vulnerability with no CVSS score yet in Apache Software Foundation Sling Engine, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.