Oracle Linux 9 : ELSA-2026-66341-0: / apr-util (ELSA-2026-663410)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663410 advisory. - Resolves: RHEL-236631 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 -...

RHEL 9 : apr-util (RHSA-2026:66341)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:66341 advisory. The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains...

USN-8719-1 apr-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. CVE-2025-49506 It was discovered that APR-util incorrectly handled recursive XML element quoting. An...

USN-8719-1: APR-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. CVE-2025-49506 It was discovered that APR-util incorrectly handled recursive XML element quoting. An...

Security update for libapr-util1

This update for libapr-util1 fixes the following issues: CVE-2025-49506: leaking content via side channel timing attack bsc1274237. CVE-2026-32327: XML stack recursion crash bsc1274235. CVE-2026-34191: SQL Injection via aprdbdoracle bsc1274850. CVE-2026-34502: heap buffer overflow in APR memcache...

SUSE-SU-2026:3905-1 Security update for libapr-util1

This update for libapr-util1 fixes the following issues: - CVE-2025-49506: leaking content via side channel timing attack bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL Injection via aprdbdoracle bsc1274850. - CVE-2026-34502: heap buffer overflow in APR...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

Amazon Linux 2023 : apr-util, apr-util-devel, apr-util-ldap (ALAS2023-2026-2115)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2115 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel...

OPENSUSE-SU-2026:21672-1 Security update for apr-util

This update for apr-util fixes the following issues: - CVE-2025-49506: hash/password content leak via side channel timing attack against aprpasswordvalidate bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL injection via aprdbdoracle bsc1274850. -...

apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

A flaw was found in the memcached client in the Apache Portable Runtime Utility apr-util. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of...

OESA-2026-3409 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

BIT-APR-UTIL-2026-34502 Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

PT-2026-73246

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

OESA-2026-3327 apr-util security update

The mission of the Apache Portable Runtime APR project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of...

SUSE CVE-2026-34502

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

CVE-2026-34502

A flaw was found in the memcached client in the Apache Portable Runtime Utility apr-util. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of...

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the memcached client implementation. An attacker can execute arbitrary code or cause a denial of service by sending specially crafted data to the affected process. Remediation Upgrade apr-util to version...

AZL-94637 CVE-2026-34502 affecting package apr-util for versions less than 1.6.3-3

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...