Cyber ·
CVE-2026-103864: Apache Sling Engine allows unneutralized CR/LF in logs
Low-severity flaw in Apache Sling Engine: request values reach logs without proper CR/LF neutralization. Versions before 3.0.4 are affected, and 3.0.4 fixes the issue. The problem is tracked as SLING-13360 and SLING-13361.
On November 5, 2026, Joerg Hoh published on the oss-sec feed an advisory for CVE-2026-103864, affecting Apache Sling Engine. According to the advisory, the component does not properly neutralize output destined for logs, so request values can reach log records without handling of carriage return (CR) and line feed (LF) characters. The stated severity is low. Affected versions are all those before 3.0.4, and users are advised to update to 3.0.4, which fixes the problem. The issue is tracked as SLING-13360 and SLING-13361. Credits go to The Apache Software Foundation as researcher and to an AI programming tool. To verify the information, consult the original advisory on the oss-sec feed and the Apache Sling project page, both referenced in the source. For readers, the relevance is that malformed log records can hinder auditing and incident analysis. The text does not indicate any relation to Rota Nacional products or services.