CVE-2026-103866

The Apache Sling Engine is vulnerable to HTTP Request/Response smuggling (CWE-444, CWE-436) in versions prior to 3.0.4 . The root cause is a hand-rolled query/form parameter parser that diverges from RFC/container parsing by accepting non-standard percent-escapes , incorrect charsets, and continu...