Skip to main content

APR-util CVE-2026-32327

| EUVDEUVD-2026-53919 CRITICAL
Uncontrolled Recursion (CWE-674)
2026-08-06 apache GHSA-qfxp-vc85-jg39
Information Disclosure Apache Portable Runtime Utility Suse Red Hat
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.5 HIGH

Uncontrolled recursion on untrusted XML is remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N) and causes a crash, so A:H; the described mechanism supports no confidentiality or integrity impact, so C:N/I:N pending vendor clarification of the C:H claim.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat
6.2 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 06, 2026 - 22:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 06, 2026 - 22:22 vuln.today
cvss_changed
Severity Changed
Aug 06, 2026 - 22:22 NVD
MEDIUM CRITICAL
CVSS changed
Aug 06, 2026 - 22:22 NVD
9.1 (MEDIUM) 9.1 (CRITICAL)
Analysis Generated
Aug 06, 2026 - 16:16 vuln.today
CVE Published
Aug 06, 2026 - 14:32 cve.org
MEDIUM

DescriptionCVE.org

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

AnalysisAI

Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library through version 1.6.3 lets remote attackers crash any consumer that parses attacker-supplied XML via apr_xml_quote_elem(). The flaw is an uncontrolled stack recursion (CWE-674) triggered by deeply nested or malicious XML; no authentication or user interaction is required. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application feed attacker-controlled XML from an untrusted source through APR-util's apr_xml_quote_elem() code path - i.e., the service must expose an XML-parsing feature (for example a WebDAV/mod_dav endpoint or any API accepting XML bodies) that reaches this function. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are mixed and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: APR-util 1.6.4 fixes the issue; upgrade to 1.6.4 or later and rebuild/redeploy any statically or dynamically linked consumers (Apache httpd, Subversion, and other XML-processing services) so they pick up the patched library. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running Apache Portable Runtime Utility version 1.6.3 or earlier, prioritizing production web servers and services that accept untrusted XML input. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Portable Runtime Utility

View all
CVE-2026-34191 CRITICAL
9.1 Aug 06

SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions
CVE-2026-34501 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated att
CVE-2026-34502 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3
CVE-2025-49506 HIGH
7.5 Aug 06

Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-a

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-32327 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy