CVE-2026-103866None▾ SunlitInconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
apache_sling_engine < 3.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103863NoneApache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
CVE-2026-103864NoneApache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
CVE-2026-111809Critical· 9.3Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
CVE-2025-55702High· 8.7Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
CVE-2025-31699High· 8.9Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
CVE-2026-111816Critical· 9.3Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out