Package · Debian

apr-util

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

12 results · Feed

High 7.5

CVE-2025-49506

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as …

Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Alpine

Aug 6, 2026
Critical 9.1

CVE-2026-32327

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this …

Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Alpine

Aug 6, 2026
Critical 9.1

CVE-2026-34191

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Alpine

Aug 6, 2026
High 7.5

CVE-2026-34501

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Alpine

Aug 6, 2026
High 7.5

CVE-2026-34502

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

Apache Software Foundation Apache Portable Runtime Utility apr-util apr-util Debian Ubuntu Alpine

Aug 6, 2026
Unscored —

CVE-2022-25147

Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.

Apache Software Foundation Apache Portable Runtime Utility (APR-util) apr-util apr-util Debian Ubuntu Alpine

Jan 31, 2023
Unscored —

CVE-2017-12618

Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used b…

Apache Software Foundation Apache Portable Runtime apr-util apr-util Debian Ubuntu

Oct 24, 2017
Unscored —

CVE-2010-1623 EPSS 20%

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility libr…

apache2 apr-util Debian

Oct 4, 2010
Unscored —

CVE-2009-2412 EPSS 14%

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka AP…

apr-util apr Debian

Aug 6, 2009
Unscored —

CVE-2009-0023

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers…

apr-util Debian

Jun 6, 2009
Unscored —

CVE-2009-1956 EPSS 12%

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows rem…

apr-util Debian

Jun 6, 2009
Unscored —

CVE-2009-1955 Public exploit EPSS 53%

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_da…

apr-util Debian

Jun 6, 2009