CVE-2026-103863

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103863", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-01T11:44:49.432Z", "datePublished": "2026-11-05T12:31:45.446Z", "dateUpdated": "2026-11-10T19:09:27.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-05T12:31:45.446Z"}, "title": "Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths", "problemTypes": [{"descriptions": [{"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "lang": "en", "cweId": "CWE-79", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-693", "lang": "en", "cweId": "CWE-693", "type": "CWE"}]}], "source": {"defect": ["SLING-13345", "SLING-13350", "SLING-13351", "SLING-13352", "SLING-13357"], "discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Sling Engine", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.\u00a0Content-Type, charset, and redirect changes from an included component evade the \u00a0protectheaders\u00a0/\u00a0checkcontenttype\u00a0 enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.&nbsp;Content-Type, charset, and redirect changes from an included component evade the &nbsp;protectheaders&nbsp;/&nbsp;checkcontenttype&nbsp; enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.</p><p>This issue affects Apache Sling Engine before 3.0.4.</p><p>Users are recommended to upgrade to version 3.0.4, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Code", "type": "tool"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/05/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T22:05:41.569Z"}}, {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T19:08:39.737532Z", "id": "CVE-2026-103863", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T19:09:27.137Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103863", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-01T11:44:49.432Z", "datePublished": "2026-11-05T12:31:45.446Z", "dateUpdated": "2026-11-10T19:09:27.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-05T12:31:45.446Z"}, "title": "Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths", "problemTypes": [{"descriptions": [{"description": "CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')", "lang": "en", "cweId": "CWE-79", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-693", "lang": "en", "cweId": "CWE-693", "type": "CWE"}]}], "source": {"defect": ["SLING-13345", "SLING-13350", "SLING-13351", "SLING-13352", "SLING-13357"], "discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Sling Engine", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.\u00a0Content-Type, charset, and redirect changes from an included component evade the \u00a0protectheaders\u00a0/\u00a0checkcontenttype\u00a0 enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.&nbsp;Content-Type, charset, and redirect changes from an included component evade the &nbsp;protectheaders&nbsp;/&nbsp;checkcontenttype&nbsp; enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.</p><p>This issue affects Apache Sling Engine before 3.0.4.</p><p>Users are recommended to upgrade to version 3.0.4, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Code", "type": "tool"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/05/6"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T22:05:41.569Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103863", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T19:08:39.737532Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T19:08:35.233Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Sling Engine", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine.\u00a0Content-Type, charset, and redirect changes from an included component evade the \u00a0protectheaders\u00a0/\u00a0checkcontenttype\u00a0 enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}], "id": "CVE-2026-103863", "lastModified": "2026-11-12T17:06:26.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103863", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T19:08:39.737532Z", "version": "2.0.3"}}]}, "published": "2026-11-05T13:17:06.880", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/05/6"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-693"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.sling/org.apache.sling.engine: Apache Sling Engine: Stored Cross-Site Scripting via header protection bypass", "id": "2567481", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567481"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["A flaw was found in Apache Sling Engine. This vulnerability allows an attacker to conduct stored Cross-Site Scripting (XSS) attacks by evading security header protections. Included components can bypass header and content-type enforcement mechanisms through manipulated response headers, character set configurations, or redirect calls, enabling malicious scripts to be stored and executed within a user's browser session."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103863", "public_date": "2026-11-05T12:31:45Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103863\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103863\nhttps://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"], "statement": "This vulnerability is evaluated with a Moderate impact rating because successful exploitation requires low-privilege authenticated access and victim interaction to trigger stored script execution. Although response header and content-type protections are evaded by included components, the blast radius is confined to the user's browser session and does not permit direct server compromise or elevated operating system privileges.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Sling Engine", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_sling_engine", "vendor": "apache"}], "created": "2026-11-05T14:00:15.132782+00:00", "updated": "2026-11-06T14:00:07.361149+00:00", "vendors": ["apache", "apache$PRODUCT$apache_sling_engine"]}