Cyber ·
CVE-2026-103866: Apache Sling Engine allows request smuggling through divergent parameter parsing
Low-severity advisory on Apache Sling Engine: inconsistent parameter parsing can enable HTTP request smuggling in versions before 3.0.4. Published November 5 via the oss-sec feed.
According to the advisory published on November 5 on the oss-sec feed, Apache Sling Engine has an inconsistent HTTP request interpretation flaw, described as 'HTTP Request/Response smuggling'. The stated severity is low. Versions before 3.0.4 are affected. The engine's query and form parser accepts non-standard percent escapes and incorrect character sets, and keeps processing the request despite these errors. This disagreement between components can let a request be read differently by proxies and by the server. The advisory recommends updating to version 3.0.4 or later. To check the original, consult the oss-sec mailing list archive for the fourth quarter of 2026 and search for the identifier CVE-2026-103866. This is a security advisory, not a tutorial, so no platform steps are given here.