Stack recursion crash in Apache Portable Runtime Utility (APR-util) (CVE-2026-32327)

A flaw in APR-util 1.6.3 and earlier allows a stack recursion attack via the `apr_xml_quote_elem()` function. Any library consumer that parses XML from untrusted sources using this function is exposed to a crash, enabling a denial-of-service condition. The issue is rated moderate severity. Affected versions: - Apache Portable Runtime Utility (APR-util) through 1.6.3 We recommend updating to: 1.6.4. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1 Details: https://vuln.today/cve/CVE-2026-32327