Apache Portable Runtime Utility: apr-util XML stack recursion crash

...

CVE-2022-4995: Unrestricted Upload of File with Dangerous Type

Weaver Fanwei E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary files, including JSP webshells, by submitting a multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp with arbitrary...

Linux Distros Unpatched Vulnerability : CVE-2025-49506

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking thei...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack in the aprpasswordvalidate function. An attacker can obtain sensitive information by measuring the time taken to compare password hashes, especially on platforms lacking the crypt function such as Windows, BeOS, NetWare, o...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the aprdbdoracle provider. An attacker can execute arbitrary SQL commands by injecting specially crafted input. Remediation Upgrade apr-util to version 1.6.5 or higher. References - Apache Mailing List...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the memcached client implementation. An attacker can execute arbitrary code or cause a denial of service by sending specially crafted data to the affected process. Remediation Upgrade apr-util to version...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the aprxmlquoteelem function. An attacker can cause a crash and potentially execute arbitrary code by providing specially crafted XML input that triggers excessive stack recursion. Remediation Upgrade apr-util ...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the redis client implementation. An attacker can execute arbitrary code or cause a denial of service by sending specially crafted data to the affected process. Remediation Upgrade apr-util to version 1.6.5 ...

AZL-94514 CVE-2026-32327 affecting package apr-util for versions less than 1.6.3-3

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

AZL-94634 CVE-2026-34501 affecting package apr-util for versions less than 1.6.3-3

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...

AZL-94637 CVE-2026-34502 affecting package apr-util for versions less than 1.6.3-3

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...

AZL-94628 CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

UBUNTU-CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2026-32327

A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

EUVD-2025-210642

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2026-32327

A stack recursion vulnerability exists in APR-util version 1.6.3 (and earlier) . The flaw occurs when the library parses XML from untrusted sources using the apr_xml_quote_elem() function, potentially leading to a Denial of Service or arbitrary code execution. Impacted components include the Apac...