Fixed packages 18
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-bdb | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-bdb-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-debugsource | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-devel | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-ldap | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-ldap-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-mysql | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-mysql-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-odbc | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-odbc-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-openssl | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-openssl-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-pgsql | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-pgsql-debuginfo | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-sqlite | 0:1.6.1-23.el9_8.1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | apr-util-sqlite-debuginfo | 0:1.6.1-23.el9_8.1 |
Vulnerabilities 4
-
Critical 9.1
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …
-
High 7.5
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
-
High 7.5
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2512073
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2512077
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2512079
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2512083
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66341.json
-
report
https://access.redhat.com/security/cve/CVE-2025-49506
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-49506
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-49506
-
article
https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5
-
report
https://access.redhat.com/security/cve/CVE-2026-32327
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-32327
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-32327
-
article
https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1
-
report
https://access.redhat.com/security/cve/CVE-2026-34501
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34501
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34501
-
article
https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv
-
report
https://access.redhat.com/security/cve/CVE-2026-34502
-
advisory
https://www.cve.org/CVERecord?id=CVE-2026-34502
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-34502
-
article
https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8