Apache Sling XSS EUVD-2026-85174

Exploitation requires that an application built on Apache Sling (version before 2.4.12) passes attacker-controlled content containing a DTD with recursively/nested-defined entities through the Sling XSS protection module's parsing path; the recursive entity references are then expanded without bound, exhausting resources. Limiting factors: the impact is confined to denial of service (no data compromise), and reachability depends on the deployment actually exposing an input that reaches the vulnerable XML/DTD parser - an application that never routes untrusted XML through the sanitizer is not exposed. Fixed by upgrading to 2.4.12.

This is a self-reported Apache advisory with NO official CVSS score, NO EPSS probability, NO CISA KEV listing, and no public exploit code identified - so quantitative risk signals are entirely absent and must be inferred from the CWE and description. CWE-776 (recursive DTD entity expansion, the classic 'billion laughs' attack) is an availability-only denial-of-service class: successful exploitation exhausts CPU/memory during XML parsing but does not disclose or alter data. Independently assessed, this looks like a network-reachable, low-complexity, unauthenticated DoS (~CVSS 7.5, A:H only) - genuinely exploitable but capped at availability impact, so it is a real hardening priority for exposed Sling/AEM deployments rather than a critical RCE-tier emergency. The key uncertainty: the description does not state exactly which input path reaches the DTD parser, so exploitability depends on whether an application actually routes attacker-controlled XML/DTD through the Sling XSS sanitizer. Because no EPSS or KEV data exists, there is no evidence of active or widespread exploitation at time of analysis - treat as a patch-on-schedule availability fix.

A remote attacker submits crafted content containing a maliciously nested/recursive DTD entity definition to a request that Apache Sling passes through its XSS protection module (versions before 2.4.12). During parsing, the recursive entities expand exponentially, exhausting server CPU and memory and rendering the Sling/AEM instance unresponsive. No public exploit code has been identified, but the 'billion laughs' technique itself is well-documented and trivial to reproduce.