Every CVE Search/ Get API key

CVE-2026-32327

Apache Portable Runtime Utility: apr-util XML stack recursion crash

9.1 CriticalFix available

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
High

Exploit likelihood

0.46%Up 0.1 points since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
EUVDEUVD-2026-53919 9.1

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
EUVD-2026-53919
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qfxp-vc85-jg39 9.1

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library...

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
GHSA-qfxp-vc85-jg39
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
NVD 9.1

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
OSVALPINE-CVE-2026-32327 9.1

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
ALPINE-CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVBELL-CVE-2026-32327 9.1
Record
BELL-CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
Show 36 moreShow less
OSV 9.1

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness
CWE-674
Updated
2026-11-02
OSVDEBIAN-CVE-2026-32327 9.1

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
DEBIAN-CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3325 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3325
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3326 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3326
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3327 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3328 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3328
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3409 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3409
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:58474 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:58474
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:66341 7.5

Red Hat Security Advisory: apr-util security update

Record
RHSA-2026:66341
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:66392 7.5

Red Hat Security Advisory: apr-util security update

Record
RHSA-2026:66392
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:69113 7.5

Red Hat Security Advisory: apr-util security update

Record
RHSA-2026:69113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:66341 7.5

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)

  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66341
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:66392 7.5

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)

  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66392
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:69113 7.5

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)

  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-32327 9.1

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
UBUNTU-CVE-2026-32327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:66341 No score

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66341
Updated
2026-11-02
OSVALSA-2026:66392 No score

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66392
Updated
2026-11-02
OSVALSA-2026:69113 No score

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69113
Updated
2026-11-02
OSVAZL-94514 No score

CVE-2026-32327 affecting package apr-util for versions less than 1.6.3-3

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
AZL-94514
Updated
2026-11-05
OSVBIT-apr-util-2026-32327 No score

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
BIT-apr-util-2026-32327
Updated
2026-11-02
OSVCLSA-2026-1786481279 No score

apr-util: Fix of 3 CVEs

  • Fix CVE-2026-34502 - heap buffer overflow in the memcached client
  • Fix CVE-2026-34501 - heap buffer overflow in the redis client
  • Fix CVE-2026-32327 - stack recursion via apr_xml_quote_elem()
Record
CLSA-2026-1786481279
Updated
2026-11-02
OSVCLSA-2026-1786495987 No score

apr-util: Fix of 2 CVEs

  • CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in apr_xml_quote_elem()
  • CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client
Record
CLSA-2026-1786495987
Updated
2026-11-02
OSVCLSA-2026-1787141541 No score

Fix CVE(s): CVE-2026-32327, CVE-2026-34501, CVE-2026-34502

  • SECURITY UPDATE: heap buffer overflow in the memcached client
    • debian/patches/CVE-2026-34502.patch: validate CRLF line termination and response lengths in memcache/apr_memcache.c
    • CVE-2026-34502
  • SECURITY UPDATE: heap buffer overflow in the redis client
    • debian/patches/CVE-2026-34501.patch: bound the bulk response length in redis/apr_redis.c
    • CVE-2026-34501
  • SECURITY UPDATE: stack recursion crash on deeply nested XML
    • debian/patches/CVE-2026-32327.patch: limit element nesting depth in xml/apr_xml.c
    • CVE-2026-32327
Record
CLSA-2026-1787141541
Updated
2026-11-02
OSVCLSA-2026-1792441215 No score

apr-util: Fix of 2 CVEs

  • CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in apr_xml_quote_elem()
Record
CLSA-2026-1792441215
Updated
2026-11-02
OSVCLSA-2026-1792441390 No score

apr-util: Fix of 2 CVEs

  • CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in apr_xml_quote_elem()
  • CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client
Record
CLSA-2026-1792441390
Updated
2026-11-02
OSVCLSA-2026-1792519677 No score

apr-util: Fix of 2 CVEs

  • CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in apr_xml_quote_elem()
  • CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client
Record
CLSA-2026-1792519677
Updated
2026-11-02
OSVMGASA-2026-0364 No score

Updated apr-util packages fix security vulnerabilities

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack. (CVE-2025-49506) Apache Portable Runtime Utility: apr-util XML stack recursion crash. (CVE-2026-32327) Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle. (CVE-2026-34191) Apache Portable Runtime Utility: Heap buffer overflow in APR redis client. (CVE-2026-34501) Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client. (CVE-2026-34502)

Record
MGASA-2026-0364
Updated
2026-11-02
OSVopenSUSE-SU-2026:21672-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2025-49506: hash/password content leak via side channel timing attack against apr_password_validate() (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
openSUSE-SU-2026:21672-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-32327 No score

CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-32327
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-32327 No score

CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-32327
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-32327 No score

CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-32327
Updated
2026-11-02
OSVSUSE-SU-2026:23551-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2025-49506: hash/password content leak via side channel timing attack against apr_password_validate() (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:23551-1
Updated
2026-11-02
OSVSUSE-SU-2026:3905-1 No score

Security update for libapr-util1

This update for libapr-util1 fixes the following issues:

  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3905-1
Updated
2026-11-02
OSVSUSE-SU-2026:3937-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3937-1
Updated
2026-11-02
OSVSUSE-SU-2026:3938-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3938-1
Updated
2026-11-02
OSVUSN-8719-1 No score

apr-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-49506)

It was discovered that APR-util incorrectly handled recursive XML element quoting. An attacker could possibly use this issue to cause applications using APR-util to crash, resulting in a denial of service. (CVE-2026-32327)

It was discovered that the APR-util Redis client incorrectly handled certain network data, resulting in a heap-based buffer overflow. A remote attacker could possibly use this issue to cause APR-util applications to crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-34501)

It was discovered that the APR-util memcached client incorrectly handled certain network data, resulting in a heap-based buffer overflow. A remote attacker could possibly use this issue to cause APR-util applications to crash or execute arbitrary code. (CVE-2026-34502)

Record
USN-8719-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apr-util
Alpine:v3.21
 before 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.22
 before 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.23
 before 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.24
 before 1.6.4-r0
1.6.4-r0
apr-util
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-bdb
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-devel
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-ldap
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-mysql
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-odbc
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
Show 182 moreShow less
Affected packages
PackageAffectedFixed
apr-util-openssl
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-pgsql
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-sqlite
AlmaLinux:9
From an advisory covering 4 CVEs
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-devel
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-ldap
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-lmdb
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-mysql
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-odbc
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-openssl
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-pgsql
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-sqlite
AlmaLinux:10
From an advisory covering 4 CVEs
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-bdb
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-devel
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-ldap
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-mysql
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-odbc
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-openssl
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-pgsql
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-sqlite
AlmaLinux:8
From an advisory covering 4 CVEs
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util
Azure Linux:3
 before 1.6.3-3
1.6.3-3
apr-util
Alpaquita:23
 1.6.1-r13 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:25
 1.6.3-r2 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:stream
 1.6.1-r13 up to 1.6.4-r0
1.6.4-r0
apr-util
Bitnami
 before 1.6.4
1.6.4
apr-util
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-bdb
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-devel
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-ldap
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-mysql
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-odbc
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-openssl
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-pgsql
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util-sqlite
TuxCare:AlmaLinux:9.6
From an advisory covering 3 CVEs
 before 1.6.1-23.el9.tuxcare.els1
1.6.1-23.el9.tuxcare.els1
apr-util
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-devel
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-ldap
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-mysql
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-nss
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-odbc
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-openssl
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-pgsql
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-sqlite
TuxCare:CentOS:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
libaprutil1
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
libaprutil1-dbd-mysql
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
libaprutil1-dbd-odbc
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
libaprutil1-dbd-pgsql
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
libaprutil1-dbd-sqlite3
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
libaprutil1-dev
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
libaprutil1-ldap
TuxCare:Ubuntu:18.04
From an advisory covering 3 CVEs
 before 1.6.1-2ubuntu0.1+tuxcare.els1
1.6.1-2ubuntu0.1+tuxcare.els1
apr-util
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util-devel
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util-ldap
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util-mysql
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util-odbc
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util-pgsql
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util-sqlite
TuxCare:OracleLinux:6
 before 1.3.9-3.el6_0.1.tuxcare.els2
1.3.9-3.el6_0.1.tuxcare.els2
apr-util
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-devel
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-ldap
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-mysql
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-nss
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-odbc
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-openssl
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-pgsql
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util-sqlite
TuxCare:RHEL:7
From an advisory covering 2 CVEs
 before 1.5.2-6.el7_9.1.tuxcare.els1
1.5.2-6.el7_9.1.tuxcare.els1
apr-util
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-devel
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-ldap
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-mysql
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-nss
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-odbc
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-openssl
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-pgsql
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util-sqlite
TuxCare:OracleLinux:7
From an advisory covering 2 CVEs
 before 1.5.2-6.0.1.el7_9.1.tuxcare.els1
1.5.2-6.0.1.el7_9.1.tuxcare.els1
apr-util
Debian:12
 before 1.6.3-1+deb12u1, plus listed versions
1.6.3-1
1.6.3-1+deb12u1
apr-util
Debian:13
 before 1.6.3-3+deb13u1, plus listed versions
1.6.3-3
1.6.3-3+deb13u1
apr-util
Debian:14
 before 1.6.4-1, plus listed versions
1.6.3-31.6.3-4
1.6.4-1
apr-util
Mageia:10
From an advisory covering 5 CVEs
 before 1.6.3-3.1.mga10
1.6.3-3.1.mga10
apr-util
Mageia:9
From an advisory covering 5 CVEs
 before 1.6.3-1.1.mga9
1.6.3-1.1.mga9
apr-util
openEuler:20.03-LTS-SP4
From an advisory covering 5 CVEs
 before 1.6.1-16.oe2003sp4
1.6.1-16.oe2003sp4
apr-util
openEuler:22.03-LTS-SP4
From an advisory covering 5 CVEs
 before 1.6.1-16.oe2203sp4
1.6.1-16.oe2203sp4
apr-util
openEuler:24.03-LTS-SP1
From an advisory covering 5 CVEs
 before 1.6.4-1.oe2403sp1
1.6.4-1.oe2403sp1
apr-util
openEuler:24.03-LTS-SP3
From an advisory covering 5 CVEs
 before 1.6.4-1.oe2403sp3
1.6.4-1.oe2403sp3
apr-util
openEuler:24.03-LTS-SP4
From an advisory covering 5 CVEs
 before 1.6.5-1.oe2403sp4
1.6.5-1.oe2403sp4
apr-util
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-devel
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-ldap
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-lmdb
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-mysql
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-odbc
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-openssl
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-pgsql
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-sqlite
Red Hat:hummingbird:1
From an advisory covering 4 CVEs
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-bdb
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-bdb-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-ldap
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-ldap-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-mysql
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-mysql-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-odbc
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-odbc-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-openssl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-openssl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-pgsql
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-pgsql-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-sqlite
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-sqlite-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-ldap
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-ldap-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-lmdb
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-lmdb-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-mysql
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-mysql-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-odbc
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-odbc-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-openssl
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-openssl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-pgsql
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-pgsql-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-sqlite
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-sqlite-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-bdb
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-bdb-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-ldap
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-ldap-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-mysql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-mysql-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-odbc
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-odbc-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-openssl
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-openssl-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-pgsql
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-pgsql-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-sqlite
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-sqlite-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util
Rocky Linux:9
From an advisory covering 4 CVEs
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util
Rocky Linux:10
From an advisory covering 4 CVEs
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util
Rocky Linux:8
From an advisory covering 4 CVEs
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 1.6.3-160000.3.1
1.6.3-160000.3.1
apr-util
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 1.6.3-160000.3.1
1.6.3-160000.3.1
libapr-util1
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 4 CVEs
 before 1.5.3-8.22.1
1.5.3-8.22.1
libapr-util1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 1.5.3-8.22.1
1.5.3-8.22.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
Ubuntu:Pro:14.04:LTS
 before 1.5.3-1ubuntu0.1~esm3, plus listed versions
1.5.2-11.5.2-1build11.5.2-2ubuntu11.5.3-11.5.3-1ubuntu0.1~esm11.5.3-1ubuntu0.1~esm2
1.5.3-1ubuntu0.1~esm3
apr-util
Ubuntu:Pro:18.04:LTS
 before 1.6.1-2ubuntu0.1+esm1, plus listed versions
1.6.0-21.6.1-11.6.1-1ubuntu21.6.1-21.6.1-2ubuntu0.1
1.6.1-2ubuntu0.1+esm1
apr-util
Ubuntu:Pro:20.04:LTS
 before 1.6.1-4ubuntu2.2+esm1, plus listed versions
1.6.1-4build11.6.1-4ubuntu11.6.1-4ubuntu21.6.1-4ubuntu2.11.6.1-4ubuntu2.2
1.6.1-4ubuntu2.2+esm1
apr-util
Ubuntu:22.04:LTS
 before 1.6.1-5ubuntu4.22.04.3, plus listed versions
1.6.1-5ubuntu21.6.1-5ubuntu31.6.1-5ubuntu41.6.1-5ubuntu4.22.04.11.6.1-5ubuntu4.22.04.2
1.6.1-5ubuntu4.22.04.3
apr-util
Ubuntu:24.04:LTS
 before 1.6.3-1.1ubuntu7.1, plus listed versions
1.6.3-1ubuntu11.6.3-1.1ubuntu51.6.3-1.1ubuntu61.6.3-1.1ubuntu7
1.6.3-1.1ubuntu7.1
apr-util
Ubuntu:26.04:LTS
 before 1.6.3-3ubuntu3.1, plus listed versions
1.6.3-3ubuntu21.6.3-3ubuntu3
1.6.3-3ubuntu3.1
apr-util
Ubuntu:Pro:14.04:LTS
From an advisory covering 4 CVEs
 before 1.5.3-1ubuntu0.1~esm3, plus listed versions
1.5.2-11.5.2-1build11.5.2-2ubuntu11.5.3-11.5.3-1ubuntu0.1~esm11.5.3-1ubuntu0.1~esm2
1.5.3-1ubuntu0.1~esm3
apr-util
Ubuntu:Pro:16.04:LTS
From an advisory covering 4 CVEs
 before 1.5.4-1ubuntu0.1~esm1, plus listed versions
1.5.4-11.5.4-1build1
1.5.4-1ubuntu0.1~esm1
apr-util
Ubuntu:Pro:18.04:LTS
From an advisory covering 4 CVEs
 before 1.6.1-2ubuntu0.1+esm1, plus listed versions
1.6.0-21.6.1-11.6.1-1ubuntu21.6.1-21.6.1-2ubuntu0.1
1.6.1-2ubuntu0.1+esm1
apr-util
Ubuntu:Pro:20.04:LTS
From an advisory covering 4 CVEs
 before 1.6.1-4ubuntu2.2+esm1, plus listed versions
1.6.1-4build11.6.1-4ubuntu11.6.1-4ubuntu21.6.1-4ubuntu2.11.6.1-4ubuntu2.2
1.6.1-4ubuntu2.2+esm1
apr-util
Ubuntu:22.04:LTS
From an advisory covering 4 CVEs
 before 1.6.1-5ubuntu4.22.04.3, plus listed versions
1.6.1-5ubuntu21.6.1-5ubuntu31.6.1-5ubuntu41.6.1-5ubuntu4.22.04.11.6.1-5ubuntu4.22.04.2
1.6.1-5ubuntu4.22.04.3
apr-util
Ubuntu:24.04:LTS
From an advisory covering 4 CVEs
 before 1.6.3-1.1ubuntu7.1, plus listed versions
1.6.3-1ubuntu11.6.3-1.1ubuntu51.6.3-1.1ubuntu61.6.3-1.1ubuntu7
1.6.3-1.1ubuntu7.1
apr-util
Ubuntu:26.04:LTS
From an advisory covering 4 CVEs
 before 1.6.3-3ubuntu3.1, plus listed versions
1.6.3-3ubuntu21.6.3-3ubuntu3
1.6.3-3ubuntu3.1
apr-util
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 1.6.3-160000.3.1
1.6.3-160000.3.1

History

History
RecordedChangedSources
affected
factsOSV
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-32327 is a critical vulnerability (CVSS 9.1) in Apache Apr-util, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 39th percentile. Fixed in apr-util 1.6.4-r0.

References

Show 77 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open