Summary
The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.
Security Fix(es):
* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
* apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
* apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
* apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | apr-util | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-devel | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-ldap | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-lmdb | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-mysql | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-odbc | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-openssl | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-pgsql | 1.6.3-23.el10_2.1 |
| AlmaLinux · 10 | apr-util-sqlite | 1.6.3-23.el10_2.1 |
Vulnerabilities 4
-
Critical 9.1
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …
-
High 7.5
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
References
-
report
https://access.redhat.com/security/cve/CVE-2025-49506
-
report
https://access.redhat.com/security/cve/CVE-2026-32327
-
report
https://access.redhat.com/security/cve/CVE-2026-34501
-
report
https://access.redhat.com/security/cve/CVE-2026-34502
-
report
https://bugzilla.redhat.com/2512073
-
report
https://bugzilla.redhat.com/2512077
-
report
https://bugzilla.redhat.com/2512079
-
report
https://bugzilla.redhat.com/2512083
-
advisory
https://errata.almalinux.org/10/ALSA-2026-66392.html