Summary
[1.6.1-9.1]
- Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information
disclosure via timing attack in password validation (CVE-2025-49506)
- Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in APR memcached client (CVE-2026-34502)
- Resolves: RHEL-236475 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in redis client (CVE-2026-34501)
- Resolves: RHEL-235668 - apr-util: APR-util: Denial of Service via XML stack
recursion attack (CVE-2026-32327)
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | apr-util | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-bdb | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-devel | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-ldap | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-mysql | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-odbc | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-openssl | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-pgsql | 0:1.6.1-9.el8_10.1 |
| Oracle Linux · 8 | apr-util-sqlite | 0:1.6.1-9.el8_10.1 |
Vulnerabilities 4
-
Critical 9.1
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …
-
High 7.5
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.