Cpe:2.3:a:apache:sling_engine:*:*:*:*:*:*:*:*

Apache Sling Engine before 3.0.4 contains an HTTP request smuggling vulnerability due to an inconsistent, hand-rolled parameter parser that fails to reject malformed percent-escapes and invalid charsets.