low advisory November 5, 2026

Apache Sling Engine: HTTP request smuggling vulnerability (CVE-2026-103866)

Apache Sling Engine before 3.0.4 contains an HTTP request smuggling vulnerability due to an inconsistent, hand-rolled parameter parser that fails to reject malformed percent-escapes and invalid charsets.

Triage facts

Revision 1

Applicability: Sling Engine (< 3.0.4)
Evidence: Unknown
Severity: Low
Action: Elevated
Sources: 1 public source
Freshness: Revision 1Nov 5, 20:26 UTC
Vulnerabilities: 1 CVE
Source quality: D3Roughly even chance

The Apache Sling Engine (versions prior to 3.0.4) implements a custom parser for query and form parameters that diverges from standard HTTP container behavior. This parser accepts non-standard percent-escapes and invalid character sets while continuing request processing, which can lead to HTTP Request/Response smuggling when the Engine and the upstream web server or proxy interpret request boundaries differently.

Impact

The discrepancy in parsing can be leveraged to bypass security controls or perform HTTP Request/Response smuggling by forcing the upstream server and the Apache Sling Engine to disagree on the structure or boundaries of the processed HTTP request.

Recommendation

Upgrade Apache Sling Engine to version 3.0.4 or later immediately.
Review web application firewall (WAF) configurations to ensure they enforce strict HTTP protocol compliance and reject requests with malformed percent-encoding or invalid character sets before they reach the Apache Sling Engine.

Immediate actions

Upgrade Apache Sling Engine to 3.0.4

IT Operations 7d

Threat Hunt

Identify requests containing non-standard percent-encodings or invalid charset headers reaching the Apache Sling infrastructure

low medium confidence convert to detection

Data: Web server access logs, WAF request logs

Mitigations