CVE-2026-103863
Last modified
CVE-2026-103863 is a vulnerability of currently unknown severity. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue..
Description
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the protectheaders / checkcontenttype enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections. This issue affects Apache Sling Engine before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Sling Engine | < 3.0.4 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-103863?
How severe is CVE-2026-103863?
How do I fix CVE-2026-103863?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-103853Dimension is affected by an out-of-bounds read vulnerability…5.5
- CVE-2026-103854Dimension is affected by a Stack-based Buffer Overflow vulne…7.8
- CVE-2026-103855Dimension is affected by a NULL Pointer Dereference vulnerab…5.5
- CVE-2026-103856Adobe Framemaker is affected by an out-of-bounds read vulner…5.5
- CVE-2026-103857Adobe Framemaker is affected by an out-of-bounds read vulner…5.5
- CVE-2026-103858MISP contains an incomplete authorization check in the discu…5.3
- CVE-2026-103864Improper output neutralization for logs in Apache Sling Engi…
- CVE-2026-103866Inconsistent interpretation of HTTP requests ('HTTP Request/…
- CVE-2026-103868A flaw was found in pulp-container when it authenticates to …6.5
- CVE-2026-103869A flaw was found in pulp-ansible's bearer-token refresh for …6.5
- CVE-2026-103870A flaw was found in pulp-rpm when it publishes a distributio…5
- CVE-2026-103875The Media Library Assistant plugin for WordPress is vulnerab…4.7
Are you affected by CVE-2026-103863?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST