Apache Portable Runtime (APR): Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• Critical 9.1
  CVE-2026-32327

  Apache Portable Runtime Utility: apr-util XML stack recursion crash

  A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026
• Critical 9.1
  CVE-2026-34191

  Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Alpine
  Aug 6, 2026
• High 7.5
  CVE-2025-49506

  Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

  APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026
• High 7.5
  CVE-2026-34501

  Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

  Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026
• High 7.5
  CVE-2026-34502

  Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

  Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

  Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Azure Linux Alpine
  Aug 6, 2026

Revision history

1. 2026-11-12 #17

   Neue Updates von SUSE aufgenommen

2. 2026-11-09 #16

   Neue Updates von openSUSE und SUSE aufgenommen

3. 2026-11-05 #15

   Neue Updates von IBM aufgenommen

4. 2026-11-03 #14

   Neue Updates von IBM aufgenommen

5. 2026-09-23 #13

   Neue Updates von Oracle Linux aufgenommen

6. 2026-09-21 #12

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

7. 2026-09-20 #11

   Neue Updates von Red Hat aufgenommen

8. 2026-09-16 #10

   Neue Updates von SUSE aufgenommen

9. 2026-09-13 #9

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

10. 2026-09-10 #8

    Neue Updates von Red Hat und Oracle Linux aufgenommen

11. 2026-09-09 #7

    Neue Updates von Red Hat und SUSE aufgenommen

12. 2026-09-03 #6

    Neue Updates von Ubuntu aufgenommen

13. 2026-08-31 #5

    Neue Updates von Amazon aufgenommen

14. 2026-08-23 #4

    Neue Updates von Red Hat aufgenommen

15. 2026-08-16 #3

    Neue Updates von Debian aufgenommen

16. 2026-08-13 #2

    Neue Updates von Debian aufgenommen

17. 2026-08-06 #1

    Initiale Fassung

References

• Apache Mailing List vom 2026-08-06
  https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5
• Apache Mailing List vom 2026-08-06
  https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1
• Apache Mailing List vom 2026-08-06
  https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf
• Apache Mailing List vom 2026-08-06
  https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv
• Apache Mailing List vom 2026-08-06
  https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8
• EU Vulnerability Database vom 2026-08-06
  https://euvd.enisa.europa.eu/vulnerability/CVE-2025-49506
• EU Vulnerability Database vom 2026-08-06
  https://euvd.enisa.europa.eu/vulnerability/CVE-2026-32327
• EU Vulnerability Database vom 2026-08-06
  https://euvd.enisa.europa.eu/vulnerability/CVE-2026-34191
• EU Vulnerability Database vom 2026-08-06
  https://euvd.enisa.europa.eu/vulnerability/CVE-2026-34501
• EU Vulnerability Database vom 2026-08-06
  https://euvd.enisa.europa.eu/vulnerability/CVE-2026-34502
• Debian Security Advisory DSA-6437 vom 2026-08-13
  https://security-tracker.debian.org/tracker/DSA-6437-1
• Debian Security Advisory DLA-4742 vom 2026-08-16
  https://lists.debian.org/debian-lts-announce/2026/08/msg00031.html
• Red Hat Security Advisory RHSA-2026:58474 vom 2026-08-22
  https://access.redhat.com/errata/RHSA-2026:58474
• Amazon Linux Security Advisory ALAS2-2026-3892 vom 2026-09-01
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3892.html
• Ubuntu Security Notice USN-8719-1 vom 2026-09-03
  https://ubuntu.com/security/notices/USN-8719-1
• Red Hat Security Advisory RHSA-2026:66341 vom 2026-09-10
  https://access.redhat.com/errata/RHSA-2026:66341
• SUSE Security Update SUSE-SU-2026:3938-1 vom 2026-09-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/028795.html
• SUSE Security Update SUSE-SU-2026:3905-1 vom 2026-09-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/028735.html
• SUSE Security Update SUSE-SU-2026:3937-1 vom 2026-09-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/028796.html
• Red Hat Security Advisory RHSA-2026:66392 vom 2026-09-10
  https://access.redhat.com/errata/RHSA-2026:66392
• Oracle Linux Security Advisory ELSA-2026-66341 vom 2026-09-10
  https://linux.oracle.com/errata/ELSA-2026-66341-0.html
• Oracle Linux Security Advisory ELSA-2026-66392 vom 2026-09-10
  https://linux.oracle.com/errata/ELSA-2026-66392-0.html
• Rocky Linux Security Advisory RLSA-2026:66341 vom 2026-09-11
  https://errata.build.resf.org/RLSA-2026:66341
• Rocky Linux Security Advisory RLSA-2026:66392 vom 2026-09-11
  https://errata.build.resf.org/RLSA-2026:66392
• SUSE Security Update SUSE-SU-2026:23551-1 vom 2026-09-16
  https://lists.suse.com/pipermail/sle-security-updates/2026-September/029116.html
• Red Hat Security Advisory RHSA-2026:69113 vom 2026-09-21
  https://access.redhat.com/errata/RHSA-2026:69113
• Rocky Linux Security Advisory RLSA-2026:69113 vom 2026-09-22
  https://errata.build.resf.org/RLSA-2026:69113
• Oracle Linux Security Advisory ELSA-2026-69113 vom 2026-09-23
  https://linux.oracle.com/errata/ELSA-2026-69113.html
• IBM Security Bulletin 7295452 vom 2026-11-03
  https://www.ibm.com/support/pages/node/7295452
• IBM Security Bulletin 7295440 vom 2026-11-03
  https://www.ibm.com/support/pages/node/7295440
• IBM Security Bulletin 7295803 vom 2026-11-06
  https://www.ibm.com/support/pages/node/7295803
• openSUSE Security Update OPENSUSE-SU-2026:22232-1 vom 2026-11-09
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/I7O4TETMLY37NXHGD5II4A6NFA3VCMQZ/
• SUSE Security Update SUSE-SU-2026:24540-1 vom 2026-11-10
  https://lists.suse.com/pipermail/sle-security-updates/2026-November/030522.html
• SUSE Security Update SUSE-SU-2026:24688-1 vom 2026-11-12
  https://lists.suse.com/pipermail/sle-security-updates/2026-November/030651.html