CVE-2026-92001: Apache Sling XSS XXE Vulnerability

CVE-2026-92001 Overview

CVE-2026-92001 is an XML entity expansion vulnerability in the Apache Sling XSS Protection API. The flaw stems from improper restriction of recursive entity references in Document Type Definitions (DTDs), classified under [CWE-776]. Apache Sling XSS versions before 2.4.12 fail to constrain nested entity expansion when processing XML content. Attackers can submit crafted XML documents that trigger exponential entity resolution, consuming excessive CPU and memory resources on the target server. The Apache Sling project has released version 2.4.12 to address the vulnerability.

Critical Impact
Remote attackers can trigger resource exhaustion through crafted XML payloads, degrading availability of Apache Sling applications that rely on the XSS Protection API for content sanitization.

Affected Products

Apache Sling XSS Protection API versions before 2.4.12
Apache Sling deployments consuming XML through the XSS module
Downstream applications embedding the vulnerable Sling XSS library

Discovery Timeline

2026-09-23 - CVE-2026-92001 published to the National Vulnerability Database
2026-09-23 - Apache Software Foundation disclosed the issue via the Openwall OSS-Security Post and Apache Mailing List Thread
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-92001

Vulnerability Analysis

Apache Sling XSS provides sanitization utilities used by Sling-based content management applications. The library parses XML input during policy loading and content validation. The vulnerable versions do not enforce limits on recursive DTD entity declarations. An attacker who can supply XML content to a Sling XSS parsing routine can define entities that reference other entities recursively.

When the parser resolves these references, expansion grows exponentially with each level of nesting. This behavior is often referred to as a "billion laughs" attack. The result is CPU and memory exhaustion within the Java Virtual Machine handling the request. The attack does not require authentication, but does require user interaction such as loading a page that triggers XML processing on attacker-supplied data.

Root Cause

The underlying XML parser used by Sling XSS was not configured to disable or bound DTD entity expansion. [CWE-776] describes this class of flaw as improper restriction of recursive entity references. Secure XML parsing requires disabling DTD processing outright or applying entity expansion limits such as jdk.xml.entityExpansionLimit. The vulnerable Sling XSS releases omit these safeguards for at least one parsing path.

Attack Vector

The vulnerability is network-reachable through any Sling endpoint that forwards XML data into the affected sanitization routines. The attacker crafts an XML payload containing nested entity references. When a victim loads a page or triggers content processing that invokes the Sling XSS API, the server expands the entities and exhausts resources. The scope changes because the impact extends beyond the Sling XSS component to the hosting application and JVM.

No verified public exploit code is available. The Apache advisory describes the class of flaw without publishing a proof of concept. See the Apache Mailing List Thread for authoritative technical detail.

Detection Methods for CVE-2026-92001

Indicators of Compromise

Sustained high CPU or heap utilization in Java processes hosting Apache Sling after processing user-submitted XML.
HTTP requests containing XML bodies with nested <!ENTITY> declarations referencing other entities.
Application logs showing SAXParseException or out-of-memory errors originating in org.apache.sling.xss packages.

Detection Strategies

Inventory application dependencies for org.apache.sling.xss and flag versions earlier than 2.4.12.
Inspect ingress traffic for XML payloads containing DTD subsets with recursive entity chains.
Correlate JVM thread dumps and garbage collection spikes with request patterns targeting Sling endpoints.

Monitoring Recommendations

Alert on abnormal request duration or memory allocation for endpoints that accept XML.
Track Apache Sling library versions across build pipelines using software composition analysis.
Enable JVM flight recorder or heap dump triggers when memory pressure crosses baseline thresholds.

How to Mitigate CVE-2026-92001

Immediate Actions Required

Upgrade Apache Sling XSS to version 2.4.12 or later across all environments.
Rebuild and redeploy any Sling-based application that bundles the vulnerable library.
Restrict network exposure of Sling endpoints that accept XML from untrusted sources.

Patch Information

The Apache Sling project fixed the vulnerability in Apache Sling XSS 2.4.12. Consult the Apache Mailing List Thread for release notes and the Openwall OSS-Security Post for the vendor advisory text. Update dependency manifests such as pom.xml to reference the fixed version and verify transitive dependencies do not reintroduce the flaw.

Workarounds

Configure the XML parser to disable DTD processing by setting the http://apache.org/xml/features/disallow-doctype-decl feature to true.
Apply a web application firewall rule that blocks XML request bodies containing recursive <!ENTITY> declarations.
Set JVM system properties jdk.xml.entityExpansionLimit and jdk.xml.totalEntitySizeLimit to conservative values to bound expansion.

bash

# Configuration example: enforce JVM-wide XML entity expansion limits
java -Djdk.xml.entityExpansionLimit=64 \
     -Djdk.xml.totalEntitySizeLimit=50000 \
     -Djdk.xml.maxGeneralEntitySizeLimit=10000 \
     -jar sling-application.jar