[SECURITY] [DSA 6437-1] apr-util security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6437-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 13, 2026 https://www.debian.org/security/faq -...

Debian dsa-6437 : libaprutil1-dbd-mysql - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6437 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6437-1 [email protected] https://www.debian.org/securit...

TencentOS Server 4: apr-util (TSSA-2026:0830)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0830 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-49506

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

CVE-2026-34501

A flaw was found in the Redis client in the Apache Portable Runtime Utility apr-util. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service. Mitigation Ensure that the Redis server used b...

CVE-2026-34502

A flaw was found in the memcached client in the Apache Portable Runtime Utility apr-util. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of...

ROOT-OS-DEBIAN-13-CVE-2026-32327 CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34191 CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34502 CVE-2026-34502 in apr-util - Patched by Root

Root has patched CVE-2026-34502 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-32327 CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34191 CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-32327 CVE-2026-32327 in apr-util - Patched by Root

Root has patched CVE-2026-32327 in the apr-util package for Root:Debian:12. Multiple fixed versions available...

Linux Distros Unpatched Vulnerability : CVE-2025-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking thei...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

UBUNTU-CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...