{"cve":"CVE-2026-103863","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[0,3.0.4)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"Apache Sling Engine","source":"cna","vendor":"Apache Software Foundation"},"product":"apache_sling_engine","vendor":"apache"}],"created":"2026-11-05T14:00:15.132782+00:00","updated":"2026-11-05T14:45:14.785499+00:00","vendors":["apache","apache$PRODUCT$apache_sling_engine"]},"mitre":{"cpes":[],"created":"2026-11-05T12:31:45.446000+00:00","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/103xxx/CVE-2026-103863.json","references":["https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"],"title":"Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths","updated":"2026-11-05T12:31:45.446000+00:00","vendors":[],"weaknesses":["CWE-693","CWE-79"]},"nvd":{"cpes":[],"created":"2026-11-05T13:17:06.880000+00:00","description":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-103863.json","references":["https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"],"title":null,"updated":"2026-11-05T13:17:06.880000+00:00","vendors":[],"weaknesses":["CWE-693","CWE-79"]},"opencve":{"changes":[{"created":"2026-11-05T12:45:00+00:00","data":[{"details":{"new":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","old":null},"type":"description"},{"details":{"new":"Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths","old":null},"type":"title"},{"details":{"added":["CWE-693","CWE-79"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"],"removed":[]},"type":"references"}],"id":"f99462aa-ba3c-4c8e-882e-b16ccb74f747"},{"created":"2026-11-05T15:00:00+00:00","data":[{"details":["apache","apache$PRODUCT$apache_sling_engine"],"type":"first_time"},{"details":{"added":["apache","apache$PRODUCT$apache_sling_engine"],"removed":[]},"type":"vendors"}],"id":"fb810968-510a-42cb-8102-64cd12946cef"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T12:31:45.446000+00:00","provider":"mitre"},"description":{"data":"Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling Engine. Content-Type, charset, and redirect changes from an included component evade the  protectheaders / checkcontenttype  enforcement through setHeader(), repeated calls to setContentType(), the charset APIs, Servlet 6.1 redirect overloads, and stale config - enabling stored XSS despite enabled protections.\n\n\n\nThis issue affects Apache Sling Engine before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://lists.apache.org/thread.html/rll7kjtbpj2lvh4nzmrw5sdmqww64ldg"],"providers":["mitre","nvd"]},"title":{"data":"Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths","provider":"mitre"},"updated":{"data":"2026-11-05T14:45:14.785499+00:00","provider":"enrichment"},"vendors":{"data":["apache","apache$PRODUCT$apache_sling_engine"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-693","CWE-79"],"providers":["mitre","nvd"]}}}