Apache Software Foundation Apache Sling Engine

• CVE-2026-103866 Unrated Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling 0.2%
• CVE-2026-103864 Unrated Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization 0.2%
• CVE-2026-103863 Unrated Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths 0.2%
• CVE-2022-45064 High 8.0 Apache Sling Engine: Include-based XSS 1.1%