CVE-2026-92001CWE-776

CVE-2026-92001

Medium · published September 23, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.

This issue affects Apache Sling XSS: before 2.4.12.

Users are recommended to upgrade to version 2.4.12, which fixes the issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-776 · Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Published
2026-09-23T14:17Z
Affected products (1)
ProductVersionsFixed in
apache/sling_xss_protection_api< 2.4.122.4.12
References (2)
https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr · [email protected]http://www.openwall.com/lists/oss-security/2026/09/23/15 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 24 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 23 SEP 09:20Z
    Apache Sling XSS: Missing parser resource limits
    cvelistv5