Skip to main content

APR-util EUVDEUVD-2026-53919

| CVE-2026-32327 CRITICAL
Uncontrolled Recursion (CWE-674)
2026-08-06 apache GHSA-qfxp-vc85-jg39
Information Disclosure Red Hat Suse Apache Portable Runtime Utility Apache Software Foundation
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.5 HIGH

Uncontrolled recursion on untrusted XML is remotely reachable with no auth or interaction (AV:N/AC:L/PR:N/UI:N) and causes a crash, so A:H; the described mechanism supports no confidentiality or integrity impact, so C:N/I:N pending vendor clarification of the C:H claim.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Red Hat
6.2 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 06, 2026 - 22:28 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 06, 2026 - 22:22 vuln.today
cvss_changed
Severity Changed
Aug 06, 2026 - 22:22 NVD
MEDIUM CRITICAL
CVSS changed
Aug 06, 2026 - 22:22 NVD
9.1 (MEDIUM) 9.1 (CRITICAL)
Analysis Generated
Aug 06, 2026 - 16:16 vuln.today
CVE Published
Aug 06, 2026 - 14:32 cve.org
MEDIUM

DescriptionCVE.org

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

AnalysisAI

Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library through version 1.6.3 lets remote attackers crash any consumer that parses attacker-supplied XML via apr_xml_quote_elem(). The flaw is an uncontrolled stack recursion (CWE-674) triggered by deeply nested or malicious XML; no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CISA SSVC framework rates it automatable, so scanning-driven abuse is plausible.

Technical ContextAI

APR-util is the utility companion to the Apache Portable Runtime, providing XML parsing, DBD/DBM, crypto, and string helpers used by projects such as Apache HTTP Server, Subversion, and mod_dav. The affected routine, apr_xml_quote_elem(), escapes/quotes XML element content produced during parsing. Per CWE-674 (Uncontrolled Recursion), the function recurses without bounding depth, so a crafted document with sufficiently nested structure drives the call stack until it exhausts, corrupting or overflowing the stack. Because this code path runs whenever a downstream consumer feeds untrusted XML through APR-util, the exposure inherits the trust boundary of the calling application (e.g., a WebDAV/DAV endpoint or any service accepting XML).

RemediationAI

Vendor-released patch: APR-util 1.6.4 fixes the issue; upgrade to 1.6.4 or later and rebuild/redeploy any statically or dynamically linked consumers (Apache httpd, Subversion, and other XML-processing services) so they pick up the patched library. If immediate upgrade is not possible, reduce exposure by restricting or disabling untrusted XML processing paths - for example, disable or firewall WebDAV/DAV (mod_dav) endpoints and any service that accepts arbitrary XML from unauthenticated clients, and place XML-accepting endpoints behind authentication or a WAF that limits XML nesting depth and body size; note these controls can break legitimate DAV/XML clients and are only stopgaps. Track the Apache advisory at https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1 and the oss-security discussion at https://seclists.org/oss-sec/2026/q3/463 for consumer-specific guidance.

More in Apache Portable Runtime Utility

View all
CVE-2026-34191 CRITICAL
9.1 Aug 06

SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions
CVE-2026-34501 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated att
CVE-2026-34502 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3
CVE-2025-49506 HIGH
7.5 Aug 06

Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-a

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2026-9769 HIGH POC
8.7
CVE-2026-40345 HIGH POC
8.2
CVE-2025-9624 HIGH POC
8.3
CVE-2019-9192 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-53919 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy