{"cve":"CVE-2026-103864","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"[0,3.0.4)"}}],"enrichment":{"confidence":100.0,"confidence_source":"matching","scores":[{"score":100.0,"source":"matching"}]},"original":{"product":"Apache Sling Engine","source":"cna","vendor":"Apache Software Foundation"},"product":"apache_sling_engine","vendor":"apache"}],"created":"2026-11-05T13:30:11.678412+00:00","updated":"2026-11-05T13:45:12.168454+00:00","vendors":["apache","apache$PRODUCT$apache_sling_engine"]},"mitre":{"cpes":[],"created":"2026-11-05T12:32:26.166000+00:00","description":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/103xxx/CVE-2026-103864.json","references":["https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"],"title":"Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization","updated":"2026-11-05T12:32:26.166000+00:00","vendors":[],"weaknesses":["CWE-117"]},"nvd":{"cpes":[],"created":"2026-11-05T13:17:07.017000+00:00","description":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-103864.json","references":["https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"],"title":null,"updated":"2026-11-05T13:17:07.017000+00:00","vendors":[],"weaknesses":["CWE-117"]},"opencve":{"changes":[{"created":"2026-11-05T12:45:00+00:00","data":[{"details":{"new":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","old":null},"type":"description"},{"details":{"new":"Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization","old":null},"type":"title"},{"details":{"added":["CWE-117"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"],"removed":[]},"type":"references"}],"id":"db316cae-a0a7-43ba-9e33-e7c87a619f69"},{"created":"2026-11-05T14:00:00+00:00","data":[{"details":["apache","apache$PRODUCT$apache_sling_engine"],"type":"first_time"},{"details":{"added":["apache","apache$PRODUCT$apache_sling_engine"],"removed":[]},"type":"vendors"}],"id":"05568d20-0b19-4eab-a7df-72348e2ac2bf"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T12:32:26.166000+00:00","provider":"mitre"},"description":{"data":"Improper output neutralization for logs in Apache Sling Engine.\n\n\n\nThis issue affects Apache Sling Engine: before 3.0.4.\n\n\n\nUsers are recommended to upgrade to version 3.0.4, which fixes the issue.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://lists.apache.org/thread.html/bchcm9xhz5zdqwykrdo4kw21j8gz6q55"],"providers":["mitre","nvd"]},"title":{"data":"Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization","provider":"mitre"},"updated":{"data":"2026-11-05T13:45:12.168454+00:00","provider":"enrichment"},"vendors":{"data":["apache","apache$PRODUCT$apache_sling_engine"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-117"],"providers":["mitre","nvd"]}}}