Product
Apache Sling Engine before 3.0.4 contains an HTTP request smuggling vulnerability due to an inconsistent, hand-rolled parameter parser that fails to reject malformed percent-escapes and invalid charsets.