{"id":"CVE-2026-34501","aliases":["ALPINE-CVE-2026-34501","ALSA-2026:66341","ALSA-2026:66392","ALSA-2026:69113","AZL-94634","BELL-CVE-2026-34501","BIT-apr-util-2026-34501","CLSA-2026-1786481279","CLSA-2026-1787141541","DEBIAN-CVE-2026-34501","EUVD-2026-53917","GHSA-m335-2qh4-r66x","MGASA-2026-0364","OESA-2026-3325","OESA-2026-3326","OESA-2026-3327","OESA-2026-3328","OESA-2026-3409","RHSA-2026:58474","RHSA-2026:66341","RHSA-2026:66392","RHSA-2026:69113","RLSA-2026:66341","RLSA-2026:66392","RLSA-2026:69113","ROOT-OS-DEBIAN-11-CVE-2026-34501","ROOT-OS-DEBIAN-12-CVE-2026-34501","ROOT-OS-DEBIAN-13-CVE-2026-34501","SUSE-SU-2026:23551-1","SUSE-SU-2026:3937-1","SUSE-SU-2026:3938-1","UBUNTU-CVE-2026-34501","USN-8719-1","openSUSE-SU-2026:21672-1","openSUSE-SU-2026:22232-1"],"status":"published","title":"Apache Portable Runtime Utility: Heap buffer overflow in APR redis client","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00508,"percentile":0.43742,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122"],"published":"2026-08-06T14:31:48Z","modified":"2026-11-10T17:27:18Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"apr-util","fixed_in":["1.6.3-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apr-util","fixed_in":["1.6.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apr-util","fixed_in":["1.6.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apr-util","fixed_in":["1.6.3-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apr-util","fixed_in":["1.6.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apr-util","fixed_in":["1.5.3-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apr-util","fixed_in":["1.6.1-2ubuntu0.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apr-util","fixed_in":["1.6.1-4ubuntu2.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"apr-util","fixed_in":["1.6.1-5ubuntu4.22.04.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"apr-util","fixed_in":["1.6.3-1.1ubuntu7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"apr-util","fixed_in":["1.6.3-3ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:9","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:10","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Azure Linux:3","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.1-r13"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.3-r2"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.1-r13"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apr-util","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-23.el9.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1-dbd-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1-dbd-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1-dbd-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1-dbd-sqlite3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libaprutil1-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1+deb12u1"}]}],"versions":["1.6.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3+deb13u1"}]}],"versions":["1.6.3-3"]},{"source":"osv","ecosystem":"Debian:14","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1"}]}],"versions":["1.6.3-3","1.6.3-4"]},{"source":"osv","ecosystem":"Mageia:10","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3.1.mga10"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.oe2403sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.5-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-bdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"apr-util-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-lmdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-lmdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"apr-util-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-bdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-bdb-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-ldap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-mysql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-mysql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-odbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-odbc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-pgsql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-pgsql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-sqlite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"apr-util-sqlite-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:9","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-23.el9_8.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:10","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-23.el10_2.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.1-9.el8_10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1ubuntu0.1~esm3"}]}],"versions":["1.5.2-1","1.5.2-1build1","1.5.2-2ubuntu1","1.5.3-1","1.5.3-1ubuntu0.1~esm1","1.5.3-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+esm1"}]}],"versions":["1.6.0-2","1.6.1-1","1.6.1-1ubuntu2","1.6.1-2","1.6.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-4ubuntu2.2+esm1"}]}],"versions":["1.6.1-4build1","1.6.1-4ubuntu1","1.6.1-4ubuntu2","1.6.1-4ubuntu2.1","1.6.1-4ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-5ubuntu4.22.04.3"}]}],"versions":["1.6.1-5ubuntu2","1.6.1-5ubuntu3","1.6.1-5ubuntu4","1.6.1-5ubuntu4.22.04.1","1.6.1-5ubuntu4.22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1ubuntu7.1"}]}],"versions":["1.6.3-1ubuntu1","1.6.3-1.1ubuntu5","1.6.3-1.1ubuntu6","1.6.3-1.1ubuntu7"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3ubuntu3.1"}]}],"versions":["1.6.3-3ubuntu2","1.6.3-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1ubuntu0.1~esm3"}]}],"versions":["1.5.2-1","1.5.2-1build1","1.5.2-2ubuntu1","1.5.3-1","1.5.3-1ubuntu0.1~esm1","1.5.3-1ubuntu0.1~esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.4-1ubuntu0.1~esm1"}]}],"versions":["1.5.4-1","1.5.4-1build1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-2ubuntu0.1+esm1"}]}],"versions":["1.6.0-2","1.6.1-1","1.6.1-1ubuntu2","1.6.1-2","1.6.1-2ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-4ubuntu2.2+esm1"}]}],"versions":["1.6.1-4build1","1.6.1-4ubuntu1","1.6.1-4ubuntu2","1.6.1-4ubuntu2.1","1.6.1-4ubuntu2.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-5ubuntu4.22.04.3"}]}],"versions":["1.6.1-5ubuntu2","1.6.1-5ubuntu3","1.6.1-5ubuntu4","1.6.1-5ubuntu4.22.04.1","1.6.1-5ubuntu4.22.04.2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1ubuntu7.1"}]}],"versions":["1.6.3-1ubuntu1","1.6.3-1.1ubuntu5","1.6.3-1.1ubuntu6","1.6.3-1.1ubuntu7"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3ubuntu3.1"}]}],"versions":["1.6.3-3ubuntu2","1.6.3-3ubuntu3"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.1","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160100.3.1"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"apr-util"},{"vendor":"apache software foundation","product":"apache portable runtime utility"}],"references":[{"url":"https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","article","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/06/11","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34501","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m335-2qh4-r66x"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34501","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66341","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-49506","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-32327","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34501","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-34502","tags":["report"]},{"url":"https://bugzilla.redhat.com/2512073","tags":["report"]},{"url":"https://bugzilla.redhat.com/2512077","tags":["report"]},{"url":"https://bugzilla.redhat.com/2512079","tags":["report"]},{"url":"https://bugzilla.redhat.com/2512083","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-66341.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66392","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-66392.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:69113","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-69113.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-34501","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786481279.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34502","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1787141541.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34501.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34501","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0364.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36181","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKNIDBBNHOGIQ7XPC4JGLXADWZC3JEUN/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00348.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34191","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3326","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3327","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3328","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3409","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:58474","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58474.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512077","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-49506","tags":["advisory"]},{"url":"https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-32327","tags":["advisory"]},{"url":"https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512073","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34501","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512083","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34502","tags":["advisory"]},{"url":"https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66341.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66392.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69113.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66341","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:66392","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:69113","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623551-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274235","tags":["report"]},{"url":"https://bugzilla.suse.com/1274237","tags":["report"]},{"url":"https://bugzilla.suse.com/1274850","tags":["report"]},{"url":"https://bugzilla.suse.com/1274852","tags":["report"]},{"url":"https://bugzilla.suse.com/1274854","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34502","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263937-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207866","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25147","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263938-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34501","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8719-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-49506","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-32327","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-34502","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34501","title":"Apache Portable Runtime Utility: Heap buffer overflow in APR redis client","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T14:31:48.356Z","modified":"2026-08-06T21:56:09.41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-53917","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T14:31:48Z","modified":"2026-08-06T21:56:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-m335-2qh4-r66x","title":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis...","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T15:32:45Z","modified":"2026-08-07T00:32:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T15:10:11.041675Z"}],"nvd":[{"id":"CVE-2026-34501","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T15:16:54.773Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"ALPINE-CVE-2026-34501","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T15:16:54.773Z","modified":"2026-10-01T02:17:49.256865661Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-34501","status":"published","published":"2026-08-09T07:59:07.433863Z","modified":"2026-08-12T07:15:05.957716233Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-34501","title":"Apache Portable Runtime Utility: Heap buffer overflow in APR redis client","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T14:31:48.356Z","modified":"2026-11-10T17:27:18.703392761Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-122"],"updated_at":"2026-11-10T17:34:47.901646Z"},{"id":"DEBIAN-CVE-2026-34501","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.  This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.  Users are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T15:16:54.773Z","modified":"2026-10-25T09:47:28.00796352Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-3325","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:42Z","modified":"2026-08-16T01:45:09.284764782Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3326","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:47Z","modified":"2026-08-16T01:45:16.261586776Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3327","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:51Z","modified":"2026-08-16T01:45:15.831923006Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3328","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:55Z","modified":"2026-08-16T01:45:09.238710768Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3409","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-20T09:54:47Z","modified":"2026-08-20T10:15:07.665212157Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"RHSA-2026:58474","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-08-22T10:27:37Z","modified":"2026-10-06T10:31:06.260735259Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:66341","title":"Red Hat Security Advisory: apr-util security update","status":"published","published":"2026-09-11T10:15:04Z","modified":"2026-09-21T10:14:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:66392","title":"Red Hat Security Advisory: apr-util security update","status":"published","published":"2026-09-11T10:15:08Z","modified":"2026-09-21T10:14:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:69113","title":"Red Hat Security Advisory: apr-util security update","status":"published","published":"2026-09-21T10:14:50Z","modified":"2026-09-22T10:19:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:66341","title":"Moderate: apr-util security update","description":"The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines.  This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.\n\nSecurity Fix(es):\n\n* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)\n\n* apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)\n\n* apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)\n\n* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:05:26.835797Z","modified":"2026-09-11T12:30:02.628474932Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:66392","title":"Moderate: apr-util security update","description":"The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines.  This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.\n\nSecurity Fix(es):\n\n* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)\n\n* apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)\n\n* apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)\n\n* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-11T12:09:43.14217Z","modified":"2026-09-11T12:30:03.608928716Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:69113","title":"Moderate: apr-util security update","description":"The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines.  This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.\n\nSecurity Fix(es):\n\n* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)\n\n* apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)\n\n* apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)\n\n* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-22T06:01:18.205216Z","modified":"2026-09-22T06:30:38.017925347Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-34501","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T15:16:00Z","modified":"2026-09-03T22:54:34.769968821Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"ALSA-2026:66341","title":"Moderate: apr-util security update","description":"The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.  \n\nSecurity Fix(es):  \n\n  * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)\n  * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)\n  * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)\n  * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-10-29T11:32:37.347832802Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:66392","title":"Moderate: apr-util security update","description":"The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.  \n\nSecurity Fix(es):  \n\n  * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)\n  * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)\n  * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)\n  * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-10T00:00:00Z","modified":"2026-10-29T11:30:42.008103036Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:69113","title":"Moderate: apr-util security update","description":"The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.  \n\nSecurity Fix(es):  \n\n  * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)\n  * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)\n  * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)\n  * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-21T00:00:00Z","modified":"2026-10-29T11:02:29.506095899Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-94634","title":"CVE-2026-34501 affecting package apr-util for versions less than 1.6.3-3","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-06T15:16:54Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"BIT-apr-util-2026-34501","title":"Apache Portable Runtime Utility: Heap buffer overflow in APR redis client","description":"Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.","status":"published","published":"2026-08-17T05:36:34.182Z","modified":"2026-09-08T08:45:48.473791098Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"CLSA-2026-1786481279","title":"apr-util: Fix of 3 CVEs","description":"- Fix CVE-2026-34502 - heap buffer overflow in the memcached client\n- Fix CVE-2026-34501 - heap buffer overflow in the redis client\n- Fix CVE-2026-32327 - stack recursion via apr_xml_quote_elem()","status":"published","published":"2026-08-13T04:21:54Z","modified":"2026-10-26T09:43:56.146306783Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1787141541","title":"Fix CVE(s): CVE-2026-32327, CVE-2026-34501, CVE-2026-34502","description":"   * SECURITY UPDATE: heap buffer overflow in the memcached client\n     - debian/patches/CVE-2026-34502.patch: validate CRLF line termination and\n       response lengths in memcache/apr_memcache.c\n     - CVE-2026-34502\n   * SECURITY UPDATE: heap buffer overflow in the redis client\n     - debian/patches/CVE-2026-34501.patch: bound the bulk response length in\n       redis/apr_redis.c\n     - CVE-2026-34501\n   * SECURITY UPDATE: stack recursion crash on deeply nested XML\n     - debian/patches/CVE-2026-32327.patch: limit element nesting depth in\n       xml/apr_xml.c\n     - CVE-2026-32327","status":"published","published":"2026-08-19T12:12:33Z","modified":"2026-10-26T09:30:09.188308926Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"MGASA-2026-0364","title":"Updated apr-util packages fix security vulnerabilities","description":"Apache Portable Runtime Utility: apr_password_validate() vulnerable to\ntiming attack. (CVE-2025-49506)\nApache Portable Runtime Utility: apr-util XML stack recursion crash.\n(CVE-2026-32327)\nApache Portable Runtime Utility: SQL Injection in apr_dbd_oracle.\n(CVE-2026-34191)\nApache Portable Runtime Utility: Heap buffer overflow in APR redis\nclient. (CVE-2026-34501)\nApache Portable Runtime Utility: Heap buffer overflow in APR memcached\nclient. (CVE-2026-34502)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:00:05.828867227Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21672-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2025-49506: hash/password content leak via side channel timing attack against `apr_password_validate()`\n  (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL injection via `apr_dbd_oracle` (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-08-28T08:23:34Z","modified":"2026-08-30T13:00:03.962053974Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"openSUSE-SU-2026:22232-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-10-27T17:00:02Z","modified":"2026-11-10T17:23:21.432767515Z","updated_at":"2026-11-10T17:35:04.393608Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-34501","title":"CVE-2026-34501 in apr-util - Patched by Root","description":"Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-20T12:05:24Z","modified":"2026-10-12T07:00:05.44986497Z","updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-34501","title":"CVE-2026-34501 in apr-util - Patched by Root","description":"Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T08:24:31Z","modified":"2026-10-09T13:00:13.021339026Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-34501","title":"CVE-2026-34501 in apr-util - Patched by Root","description":"Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-23T14:06:54Z","modified":"2026-10-08T13:00:07.356843391Z","updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"SUSE-SU-2026:23551-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2025-49506: hash/password content leak via side channel timing attack against `apr_password_validate()`\n  (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL injection via `apr_dbd_oracle` (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-08-28T08:24:33Z","modified":"2026-09-29T18:23:08.353385664Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3937-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).\n- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-09-03T07:29:20Z","modified":"2026-09-10T18:23:18.062427971Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3938-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).\n- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-09-03T07:30:47Z","modified":"2026-09-10T18:23:18.07394636Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8719-1","title":"apr-util vulnerabilities","description":"It was discovered that APR-util incorrectly performed password hash\ncomparisons in a way that was not constant-time.\nAn attacker could possibly use this issue to obtain sensitive information.\n(CVE-2025-49506)\n\nIt was discovered that APR-util incorrectly handled recursive XML element\nquoting. An attacker could possibly use this issue to cause applications\nusing APR-util to crash, resulting in a denial of service.\n(CVE-2026-32327)\n\nIt was discovered that the APR-util Redis client incorrectly handled\ncertain network data, resulting in a heap-based buffer overflow. A remote\nattacker could possibly use this issue to cause APR-util applications to\ncrash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.\n(CVE-2026-34501)\n\nIt was discovered that the APR-util memcached client incorrectly handled\ncertain network data, resulting in a heap-based buffer overflow. A remote\nattacker could possibly use this issue to cause APR-util applications to\ncrash or execute arbitrary code. (CVE-2026-34502)","status":"published","published":"2026-09-03T12:35:55Z","modified":"2026-09-03T22:56:56.444287327Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}