USN-8719-1: APR-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. CVE-2025-49506 It was discovered that APR-util incorrectly handled recursive XML element quoting. An...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

Amazon Linux 2023 : apr-util, apr-util-devel, apr-util-ldap (ALAS2023-2026-2115)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2115 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel...

Important: apr-util

Issue Overview: APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or...

Amazon Linux 2 : apr-util, --advisory ALAS2-2026-3892 (ALAS-2026-3892)

The version of apr-util installed on the remote host is prior to 1.6.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3892 advisory. APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or password...

openSUSE 16: apr-util-devel / libapr-util1-0 / libapr-util1-0-dbd-mysql / etc (openSUSE-SU-2026:21672-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21672-1 advisory. - CVE-2025-49506: hash/password content leak via side channel timing attack against aprpasswordvalidate bsc1274237. - CVE-2026-32327: XML stack...

OPENSUSE-SU-2026:21672-1 Security update for apr-util

This update for apr-util fixes the following issues: - CVE-2025-49506: hash/password content leak via side channel timing attack against aprpasswordvalidate bsc1274237. - CVE-2026-32327: XML stack recursion crash bsc1274235. - CVE-2026-34191: SQL injection via aprdbdoracle bsc1274850. -...

[SECURITY] Fedora 43 Update: apr-util-1.6.5-1.fc43

The mission of the Apache Portable Runtime APR is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more...

Fedora 43 : apr-util (2026-1ba2df871e)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-1ba2df871e advisory. - new version 1.6.5 - security fixes Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has n...

ROOT-OS-DEBIAN-12-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-34502 CVE-2026-34502 in apr-util - Patched by Root

Root has patched CVE-2026-34502 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32327 CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-34191 CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-32327 CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34191 CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34502 CVE-2026-34502 in apr-util - Patched by Root

Root has patched CVE-2026-34502 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client

A flaw was found in the Redis client in the Apache Portable Runtime Utility apr-util. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service...