Cve-2026-103866 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-103866/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 20:26:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Sling Engine: HTTP request smuggling vulnerability (CVE-2026-103866)https://feed.craftedsignal.io/briefs/2026-11-apache-sling-smuggling/Thu, 05 Nov 2026 20:26:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-apache-sling-smuggling/Apache Sling Engine before 3.0.4 contains an HTTP request smuggling vulnerability due to an inconsistent, hand-rolled parameter parser that fails to reject malformed percent-escapes and invalid charsets.The Apache Sling Engine (versions prior to 3.0.4) implements a custom parser for query and form parameters that diverges from standard HTTP container behavior. This parser accepts non-standard percent-escapes and invalid character sets while continuing request processing, which can lead to HTTP Request/Response smuggling when the Engine and the upstream web server or proxy interpret request boundaries differently.

Impact

The discrepancy in parsing can be leveraged to bypass security controls or perform HTTP Request/Response smuggling by forcing the upstream server and the Apache Sling Engine to disagree on the structure or boundaries of the processed HTTP request.

Recommendation

  • Upgrade Apache Sling Engine to version 3.0.4 or later immediately.
  • Review web application firewall (WAF) configurations to ensure they enforce strict HTTP protocol compliance and reject requests with malformed percent-encoding or invalid character sets before they reach the Apache Sling Engine.
]]>lowadvisorycve-2026-103866smugglingweb-vulnerabilityhttp