CVE-2026-103864
Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Exploit likelihood
What each source reports
CVE List No score
Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
CVE-2026-103864- Weakness
- CWE-117
- Updated
- 2026-11-05
EUVDEUVD-2026-117432 No score
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
EUVD-2026-117432- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-26c9-4vq3-99qm No score
Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache...
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
GHSA-26c9-4vq3-99qm- Weakness
- CWE-117
- Updated
- 2026-11-06
NVD No score
Improper output neutralization for logs in Apache Sling Engine.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
CVE-2026-103864- Weakness
- CWE-117
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103864 is a vulnerability with no CVSS score yet in Apache Software Foundation Sling Engine, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. No source names a fixed version.