CVE-2012-2138: The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Ap...

Security readout for executives and security teams

CVE-2012-2138 is a denial-of-service flaw in Apache Sling's POST servlet. A crafted remote request can trigger an infinite loop when the servlet copies a parent content node into one of its descendants. The business impact is service disruption, not data theft, based on the provided sources. Exposure is most likely where Apache Sling uses org.apache.sling.servlets.post before 2.1.2 and the POST servlet is reachable by untrusted users. The source bundle does not identify specific packaged products, distributions, or configurations beyond Apache Sling's servlet bundle. Schedule remediation for affected Sling systems, especially externally reachable services. This is a denial-of-service issue with no confirmed active exploitation in the provided sources, so it is typically urgent for exposed production systems but below remote code execution or data compromise vulnerabilities. Mitigation focus: Upgrade org.apache.sling.servlets.post to version 2.1.2 or later.; Review the Apache Sling security announcement for deployment-specific guidance.; Prioritize internet-facing or partner-facing Sling deployments first..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.