Red Hat Security Advisory

RHSA-2026:58474

Red Hat Hardened Images RPMs bug fix and enhancement update

Released 2026-08-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Hardened Images apr-util-1.6.5-1.hum1@aarch64, apr-util-1.6.5-1.hum1@src, apr-util-1.6.5-1.hum1@x86_64 +16

Fixes 4 records

TI-2026-24855 CVE-2026-32327 · GHSA-qfxp-vc85-jg39

Apache Portable Runtime Utility: apr-util XML stack recursion crash

MEDIUM 46

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00458 Published 2026-08-06 Partial fix CWE-674

TI-2026-26754 CVE-2026-34502 · GHSA-m2cw-c66m-j23g

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

LOW 39

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00508 Published 2026-08-06 Partial fix CWE-122

TI-2026-26753 CVE-2026-34501 · GHSA-m335-2qh4-r66x

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

LOW 39

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00508 Published 2026-08-06 Partial fix CWE-122

TI-2025-31532 CVE-2025-49506 · GHSA-73wm-47mq-62r5

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

LOW 39

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularl…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2026-08-06 Partial fix CWE-208