CVE-2026-103866

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103866", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-01T11:47:21.504Z", "datePublished": "2026-11-05T12:33:00.994Z", "dateUpdated": "2026-11-10T15:55:22.562Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-05T12:33:00.994Z"}, "title": "Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling", "problemTypes": [{"descriptions": [{"description": "CWE-436", "lang": "en", "cweId": "CWE-436", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')", "lang": "en", "cweId": "CWE-444", "type": "CWE"}]}], "source": {"defect": ["SLING-13362", "SLING-13364", "SLING-13365"], "discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Sling Engine", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.\u00a0The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.&nbsp;The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.</p><p>This issue affects Apache Sling Engine: before 3.0.4.</p><p>Users are recommended to upgrade to version 3.0.4, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Code", "type": "tool"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/05/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T22:05:44.167Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T15:55:18.133309Z", "id": "CVE-2026-103866", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T15:55:22.562Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-103866", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-01T11:47:21.504Z", "datePublished": "2026-11-05T12:33:00.994Z", "dateUpdated": "2026-11-10T15:55:22.562Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-11-05T12:33:00.994Z"}, "title": "Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling", "problemTypes": [{"descriptions": [{"description": "CWE-436", "lang": "en", "cweId": "CWE-436", "type": "CWE"}]}, {"descriptions": [{"description": "CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')", "lang": "en", "cweId": "CWE-444", "type": "CWE"}]}], "source": {"defect": ["SLING-13362", "SLING-13364", "SLING-13365"], "discovery": "UNKNOWN"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Sling Engine", "versions": [{"status": "affected", "version": "0", "lessThan": "3.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.\u00a0The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.&nbsp;The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.</p><p>This issue affects Apache Sling Engine: before 3.0.4.</p><p>Users are recommended to upgrade to version 3.0.4, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "The Apache Software Foundation", "type": "finder"}, {"lang": "en", "value": "Claude Code", "type": "tool"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/11/05/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-11-05T22:05:44.167Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-103866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T15:55:18.133309Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T15:54:43.507Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Sling Engine", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine.\u00a0The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue."}], "id": "CVE-2026-103866", "lastModified": "2026-11-12T17:06:26.857", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103866", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T15:55:18.133309Z", "version": "2.0.3"}}]}, "published": "2026-11-05T13:17:07.143", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/11/05/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-436"}, {"lang": "en", "value": "CWE-444"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.sling/org.apache.sling.engine: Apache Sling Engine: HTTP request smuggling via malformed query and form parsing", "id": "2567547", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567547"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in Apache Sling Engine. A remote attacker could perform HTTP request smuggling by sending specially crafted requests containing non-standard percent-encoded characters or invalid character sets. Because the query and form parser continues processing requests despite encountering formatting errors, front-end and back-end systems may interpret request boundaries differently. This desynchronization can allow an attacker to bypass security controls or poison web caches."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-103866", "public_date": "2026-11-05T12:33:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-103866\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-103866\nhttps://lists.apache.org/thread.html/yoftbty2lc7kmtldmyvj7w0m0n1ncbf6"], "statement": "This vulnerability is rated with Low severity because successful HTTP request smuggling requires a specific proxy-to-backend architecture with mismatched request parsing behavior and timing conditions to achieve limited manipulation of adjacent requests. In typical Red Hat deployments, Apache Sling is rarely deployed as a directly exposed public frontend, and exploitation relies on fronting infrastructure forwarding malformed query strings or encoding anomalies rather than rejecting them at the perimeter. Because the underlying flaw does not permit arbitrary code execution, confidential data disclosure, or direct privilege escalation on the host system, the overall security risk remains low.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.0.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Sling Engine", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "apache_sling_engine", "vendor": "apache"}], "created": "2026-11-05T13:45:12.168082+00:00", "updated": "2026-11-11T16:15:21.810542+00:00", "vendors": ["apache", "apache$PRODUCT$apache_sling_engine"]}