{"schema_version": "1.6.1", "id": "CVE-2026-92001", "summary": "Missing parser resource limits", "details": "Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS.\n\n\n\nThis issue affects Apache Sling XSS: before 2.4.12.\n\n\n\nUsers are recommended to upgrade to version 2.4.12, which fixes the issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "2.4.12"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/m52jll26vc8g5jokbg0xt062o09wkghr"}]}