Cyber ·
CVE-2026-103863: Apache Sling Engine, protections against inclusion can be bypassed
Low-severity advisory for Apache Sling Engine. Content-Type, charset and redirect changes made by an included component can escape protectheaders and checkcontenttype checks. Versions before 3.0.4 are affected.
What was disclosed: a cross-site scripting weakness in Apache Sling Engine during web page generation. According to the text, Content-Type, charset and redirect changes made by an included component bypass protectheaders and checkcontenttype. The text cites setHeader(), repeated setContentType() calls, charset APIs and Servlet 6.1 as paths.
Affected versions: Apache Sling Engine before 3.0.4. The stated severity is low. The advisory was posted to the oss-sec feed on November 5, 2026 by a project maintainer. This text is an automatic translation of the original advisory; check the original English version and technical details at the official source.
Relevance: teams running Sling-based Java applications should check the installed component version and, if needed, upgrade to 3.0.4 or later. This news involves no personal data and no Rota Nacional feature.
How to verify: consult the original advisory on the oss-sec feed, locate the Apache Sling Engine reference and compare your installed version with the fixed version stated.