Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths

published 2026-11-05 4d ago modified 2026-11-05 4d ago also EUVD-2026-117431

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.

This issue affects Apache Sling Engine before 3.0.4.

Users are recommended to upgrade to version 3.0.4, which fixes the issue.

Patch / fix

fixed in 1

Apache Software Foundation Apache Sling Engine 3.0.4

Is CVE-2026-103863 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-103863 updated 2026-11-06 cvss 5.4

org.apache.sling/org.apache.sling.engine: Apache Sling Engine: Stored Cross-Site Scripting via header protection bypass

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-09).

Affected products

Apache Software Foundation Apache Sling Engine

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation
CWE-693 Protection Mechanism Failure

References

Sources

CVE List CVE-2026-103863
NVD CVE-2026-103863

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.