Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the redis client implementation. An attacker can execute arbitrary code or cause a denial of service by sending specially crafted data to the affected process. Remediation Upgrade apr-util to version 1.6.5 ...

AZL-94634 CVE-2026-34501 affecting package apr-util for versions less than 1.6.3-3

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

AZL-94514 CVE-2026-32327 affecting package apr-util for versions less than 1.6.3-3

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

AZL-94637 CVE-2026-34502 affecting package apr-util for versions less than 1.6.3-3

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

AZL-94628 CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

UBUNTU-CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

EUVD-2025-210642

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2026-32327

A stack recursion vulnerability exists in APR-util version 1.6.3 (and earlier) . The flaw occurs when the library parses XML from untrusted sources using the apr_xml_quote_elem() function, potentially leading to a Denial of Service or arbitrary code execution. Impacted components include the Apac...

CVE-2026-32327 Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2026-32327: Uncontrolled Recursion

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2025-49506: Observable Timing Discrepancy

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

PT-2026-68523

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime Utility versions 1.3.0 through 1.6.3 Description A heap-based buffer overflow occurs in the memcached client. A heap-based buffer overflow is a memory corruption issue that happens when an application writes more data t...

PT-2026-68498

Name of the Vulnerable Software and Affected Versions APR-util versions prior to 1.6.4 Description The function apr password validate does not operate in constant-time when comparing hashes or passwords. This behavior can lead to the leakage of sensitive content through a side channel timing...

PT-2026-68518

Name of the Vulnerable Software and Affected Versions APR-util versions prior to 1.6.4 Description A bug allows a stack recursion attack against any library consumer that parses XML from untrusted sources and utilizes the apr xml quote elem function. Recommendations Upgrade to version 1.6.4...