Apache Portable Runtime Utility
Monthly
Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library through version 1.6.3 lets remote attackers crash any consumer that parses attacker-supplied XML via apr_xml_quote_elem(). The flaw is an uncontrolled stack recursion (CWE-674) triggered by deeply nested or malicious XML; no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CISA SSVC framework rates it automatable, so scanning-driven abuse is plausible.
SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.
Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3) allows remote unauthenticated attackers to crash affected applications, causing denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms full availability impact with no confidentiality or integrity exposure. No public exploit identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning is feasible once attack primitives are established.
Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-accessible attackers to statistically recover passwords or hashes by measuring response-time variance in the `apr_password_validate()` function, which performs non-constant-time comparisons. The risk is materially elevated on platforms lacking native `crypt()` support - specifically Windows, Android, BeOS, and NetWare - where the non-constant-time code path is always exercised rather than conditionally. No public exploit has been identified at time of analysis, though the SSVC framework assesses the attack as automatable with partial technical impact.
Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library through version 1.6.3 lets remote attackers crash any consumer that parses attacker-supplied XML via apr_xml_quote_elem(). The flaw is an uncontrolled stack recursion (CWE-674) triggered by deeply nested or malicious XML; no authentication or user interaction is required. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the CISA SSVC framework rates it automatable, so scanning-driven abuse is plausible.
SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated attackers to crash applications that use the library, resulting in a denial of service. Affected versions span APR-util 1.6.0 through 1.6.3; version 1.6.4 resolves the issue per Apache's advisory on the oss-security mailing list. No public exploit code and no CISA KEV listing have been identified at time of analysis, though SSVC classifies the flaw as automatable with partial technical impact, indicating it could be scripted for broad scanning.
Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3) allows remote unauthenticated attackers to crash affected applications, causing denial of service. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms full availability impact with no confidentiality or integrity exposure. No public exploit identified at time of analysis, but SSVC marks this as automatable, meaning scripted mass scanning is feasible once attack primitives are established.
Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-accessible attackers to statistically recover passwords or hashes by measuring response-time variance in the `apr_password_validate()` function, which performs non-constant-time comparisons. The risk is materially elevated on platforms lacking native `crypt()` support - specifically Windows, Android, BeOS, and NetWare - where the non-constant-time code path is always exercised rather than conditionally. No public exploit has been identified at time of analysis, though the SSVC framework assesses the attack as automatable with partial technical impact.