CVE-2026-92001
UnknownSummary
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
Risk Assessment
XML entity expansion can lead to XML Entity Expansion attacks, potentially causing resource exhaustion and denial of service.
Recommendation
Upgrade Apache Sling XSS to version 2.4.12 or later.
Other vulnerabilities in Apache Sling XSS
See all- CVE-2026-91999Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91928Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-91852Unknown
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects versions before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.
- CVE-2026-73192Unknown
A reflected cross-site scripting (CWE-79) vulnerability in Apache Sling XSS version 2.4.10 and prior, caused by improper neutralization of input in the XSSAPI.getValidHref() method. An attacker can submit an unsanitized value, allowing script execution in the victim's browser in every feature using this method.
Original NVD description (English source)
Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.