CVE-2026-103866
Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Exploit likelihood
What each source reports
CVE List No score
Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
CVE-2026-103866- Weakness
- CWE-436, CWE-444
- Updated
- 2026-11-05
EUVDEUVD-2026-117433 No score
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
EUVD-2026-117433- Updated
- 2026-11-05
GitHub AdvisoriesGHSA-fh7f-x3gj-j2vv No score
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in...
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
GHSA-fh7f-x3gj-j2vv- Weakness
- CWE-436
- Updated
- 2026-11-06
NVD No score
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
- Record
CVE-2026-103866- Weakness
- CWE-436, CWE-444
- Updated
- 2026-11-05
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| references | CVE List, EUVD, NVD | |
| first indexed | CVE List, EUVD, GitHub Advisories |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103866 is a vulnerability with no CVSS score yet in Apache Software Foundation Sling Engine, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. No source names a fixed version.