{"schema_version": "1.6.1", "id": "CVE-2026-91928", "summary": "Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms", "details": "Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "2.4.12"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/yfb1q6zob8mth5lr4jnsy3lhx9rfwb02"}]}