Apache Software Foundation Portable Runtime vulnerabilities

• apache apr-util, apache software foundation portable runtime utility +1 more Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack CVE-2025-49506 Fix available 7.5 HighAugust 6, 2026
• apache apr-util, apache software foundation portable runtime utility +1 more Apache Portable Runtime Utility: apr-util XML stack recursion crash CVE-2026-32327 Fix available 9.1 CriticalAugust 6, 2026
• apache software foundation portable runtime utility, apache apr-util +1 more Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle CVE-2026-34191 Fix available 9.1 CriticalAugust 6, 2026
• apache software foundation portable runtime utility, apache apr-util +1 more Apache Portable Runtime Utility: Heap buffer overflow in APR redis client CVE-2026-34501 Fix available 7.5 HighAugust 6, 2026
• apache software foundation portable runtime utility, apache apr-util +1 more Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 Fix available 7.5 HighAugust 6, 2026
• apache portable runtime (apr), portable runtime +1 more Apache Portable Runtime (APR): Unexpected lax shared memory permissions CVE-2023-49582 Fix available 5.5 MediumAugust 26, 2024
• apache portable runtime (apr), portable runtime +1 more Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function CVE-2022-28331 Fix available 9.8 CriticalJanuary 31, 2023
• apache portable runtime utility, apache software foundation portable runtime utility (apr-util) +1 more Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions CVE-2022-25147 Fix available 6.5 MediumJanuary 31, 2023
• apache portable runtime (apr), portable runtime +1 more Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions CVE-2022-24963 Fix available 9.8 CriticalJanuary 31, 2023
• apache portable runtime, portable runtime (apr), oracle http server +2 more Regression of CVE-2017-12613 CVE-2021-35940 Fix available 7.1 HighAugust 23, 2021
• apache portable runtime utility, apache software foundation portable runtime +1 more Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM... CVE-2017-12618 Fix available 4.7 MediumOctober 24, 2017
• apache portable runtime, debian linux, redhat enterprise linux desktop +8 more +10 more When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field... CVE-2017-12613 Fix available 7.1 HighOctober 24, 2017