Red Hat Security Advisory

RHSA-2026:66392

apr-util security update

Released 2026-09-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) apr-util-1.6.3-23.el10_2.1, apr-util-devel-1.6.3-23.el10_2.1, apr-util-ldap-1.6.3-23.el10_2.1 +6

Fixes 4 records

TI-2026-24855 CVE-2026-32327 · GHSA-qfxp-vc85-jg39

Apache Portable Runtime Utility: apr-util XML stack recursion crash

MEDIUM 46

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00458 Published 2026-08-06 Partial fix CWE-674

TI-2026-26754 CVE-2026-34502 · GHSA-m2cw-c66m-j23g

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

LOW 39

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00508 Published 2026-08-06 Partial fix CWE-122

TI-2026-26753 CVE-2026-34501 · GHSA-m335-2qh4-r66x

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

LOW 39

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00508 Published 2026-08-06 Partial fix CWE-122

TI-2025-31532 CVE-2025-49506 · GHSA-73wm-47mq-62r5

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

LOW 39

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularl…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2026-08-06 Partial fix CWE-208