CVE-2026-92001 PUBLISHED

Apache Sling XSS: Missing parser resource limits

Assigner: apache
Reserved: 15.09.2026 Published: 23.09.2026 Updated: 23.09.2026

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.

This issue affects Apache Sling XSS: before 2.4.12.

Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache Sling XSS
Versions Default: unaffected
  • affected from 0 to 2.4.12 (excl.)

Credits

  • The Apache Software Foundation finder
  • Claude Code tool

References

Problem Types

  • CWE-776 Improper restriction of recursive entity references in DTDs ('XML entity expansion') CWE