Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Fixed packages 9

Vulnerabilities 4

• Critical 9.1
  CVE-2026-32327

  Apache Portable Runtime Utility: apr-util XML stack recursion crash

  A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026
• High 7.5
  CVE-2025-49506

  Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

  APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026
• High 7.5
  CVE-2026-34501

  Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

  Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026
• High 7.5
  CVE-2026-34502

  Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

  Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026

References

• article
  https://images.redhat.com/
• report
  https://access.redhat.com/security/cve/CVE-2025-49506
• article
  https://access.redhat.com/security/updates/classification/
• report
  https://access.redhat.com/security/cve/CVE-2026-34501
• report
  https://access.redhat.com/security/cve/CVE-2026-34502
• report
  https://access.redhat.com/security/cve/CVE-2026-32327
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_58474.json
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2512077
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-49506
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-49506
• article
  https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2512079
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32327
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32327
• article
  https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2512073
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34501
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34501
• article
  https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2512083
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34502
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34502
• article
  https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8