PT-2026-73243

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr xml quote elem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

[SECURITY] [DLA 4742-1] apr-util security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4742-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès August 16, 2026 https://wiki.debian.org/LTS -...

Debian dla-4742 : libaprutil1 - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4742 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4742-1 [email protected]...

[SECURITY] [DSA 6437-1] apr-util security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6437-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 13, 2026 https://www.debian.org/security/faq -...

OESA-2026-3328 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

OESA-2026-3327 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

OESA-2026-3326 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

OESA-2026-3325 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

[SECURITY] Fedora 44 Update: apr-util-1.6.5-1.fc44

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more...

Fedora 44 : apr-util (2026-edfb6293ee)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-edfb6293ee advisory. - new version 1.6.5 - security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

Debian dsa-6437 : libaprutil1-dbd-mysql - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6437 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6437-1 [email protected] https://www.debian.org/securit...

TencentOS Server 4: apr-util (TSSA-2026:0830)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0830 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-49506

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

CVE-2026-34501

A flaw was found in the Redis client in the Apache Portable Runtime Utility apr-util. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service. Mitigation Ensure that the Redis server used b...

CVE-2026-34502

A flaw was found in the memcached client in the Apache Portable Runtime Utility apr-util. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of...

Photon OS 5.0: Apr PHSA-2024-5.0-91-0375

An update of the apr package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0375. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

...

SUSE CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

Apache Portable Runtime Utility: apr-util XML stack recursion crash

...

Linux Distros Unpatched Vulnerability : CVE-2025-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking thei...