CVE-2026-91928 PUBLISHED

Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Assigner: apache
Reserved: 15.09.2026 Published: 23.09.2026 Updated: 23.09.2026

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.

This issue affects Apache Sling XSS: before 2.4.12.

Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Sling XSS
Versions Default: unaffected
  • affected from 0 to 2.4.12 (excl.)

Credits

  • The Apache Software Foundation finder
  • Claude Code tool

References

Problem Types

  • CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE