Miroslav Radic, 45, the third of the group known as the "Vukovar Three", was found to have had nothing to do with the cruelty meted out to the hospital evacuees and ultimately their murder.
Prosecutors had demanded life imprisonment, and the decision by the three judges was regarded as a crushing disappointment in Croatia.
Croatian state-run radio said the sentence was "shocking for our public and for the families of the victims".
"There clearly is no justice for the Vukovar victims," said Vesna Bosanac, a doctor at the Vukovar hospital at the time.
Radic was ordered to be released immediately. Sljivancanin, who was arrested by Serb authorities in June 2003, will be credited for his time in detention and will be released within a year.
The hospital in the eastern Croatian town fell to the Serb army in November 1991 after a three-month siege that virtually levelled the town.
The hospital was among some of the last places to be captured and was packed with patients, hospital staff and civilians who took refuge in its corridors.
The evacuation of the hospital earned particular notoriety after the Serbs failed to live up to an agreement with the Red Cross and other international observers to monitor the surrender.
When the agreed hour approached, an armoured Serb vehicle blocked the observers' access across a bridge to the hospital while buses took another route to smuggle out the men seized inside the building.
More than 200 men were taken first to a Serb army barracks, then to a pig farm at Ovcara where they passed through lines of soldiers who "beat them with wooden sticks, rifle butts poles chains and even crutches", said a court statement.
Their guards formed "shifts of beaters" in an unrelenting night of torture.
On the night of November 20, Mrksic ordered the Serb army and military police to withdraw. The paramilitary forces took the men in small groups to an area nearby and shot them.
Though charged with the murders of 264 people, the court convicted Mrksic of aiding and abetting the murders of fewer - only the number of bodies dug up and identified from the mass grave on the site of the massacre.
The court found that Sljivancanin, who was in charge of the military police, failed in his duty to adequately defend the prisoners even though he was "able to observe the brutal conduct of the Territorial Defence and paramilitary forces".