Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-34502: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3. CVE-2026-34501: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue. CVE-2026-32327: A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue. CVE-2025-49506: APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | apr-util | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-debugsource | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-devel | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-ldap | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-ldap-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-lmdb | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-lmdb-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-mysql | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-mysql-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-odbc | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-odbc-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-openssl | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-openssl-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-pgsql | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-pgsql-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-sqlite | 0:1.6.5-1.amzn2023.0.1 |
| Amazon Linux · 2023 | apr-util-sqlite-debuginfo | 0:1.6.5-1.amzn2023.0.1 |
Vulnerabilities 4
-
Critical 9.1
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …
-
High 7.5
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.