anonhaven

CVE-2026-92001

NONE
Updated Sep 23, 2026
Apache Software Foundation
Parameter Value
Affected Versions before 2.4.12.
Fixed In 2.4.12
Type CWE-776
Vendor Apache Software Foundation
Public PoC No

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

Weakness Type (CWE)

CWE-776

Vulnerable Products

apache software foundation:apache sling xss

References 1

https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr
security@apache.org
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-96443

Apache Software Foundation

None

CVE-2026-94251

Apache Software Foundation

None

CVE-2026-94243

Apache Software Foundation

None

CVE-2026-91999

Apache Software Foundation

None

CVE-2026-91928

Apache Software Foundation

None