A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apr-util | Aug 10, 2026 | Aug 6, 2026 |
| Amazon_linux_2023 | — | Upgrade apr-util-openssl-debuginfoUpgrade apr-utilUpgrade apr-util-pgsqlUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-opensslUpgrade apr-util-ldap-debuginfoUpgrade apr-util-develUpgrade apr-util-mysqlUpgrade apr-util-odbc-debuginfoUpgrade apr-util-ldapUpgrade apr-util-debugsourceUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-lmdbUpgrade apr-util-odbcUpgrade apr-util-mysql-debuginfoUpgrade apr-util-debuginfoUpgrade apr-util-sqlite | Sep 1, 2026 | Aug 6, 2026 |
| Debian | — | Upgrade apr-util | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | Upgrade apr-util-ldapUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-ldap-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-odbc-debuginfoUpgrade apr-util-odbcUpgrade apr-util-openssl-debuginfoUpgrade apr-util-develUpgrade apr-util-mysql-debuginfoUpgrade apr-util-lmdbUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-bdb-debuginfoUpgrade apr-util-opensslUpgrade apr-util-pgsqlUpgrade apr-util-sqliteUpgrade apr-util-bdbUpgrade apr-util-debuginfoNo solution existsUpgrade apr-util-mysqlUpgrade apr-utilUpgrade apr-util-debugsource | Aug 12, 2026 | Aug 6, 2026 |
| Rocky_linux | — | Upgrade apr-util-pgsqlUpgrade apr-util-openssl-debuginfoUpgrade apr-util-mysqlUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-bdb-debuginfoUpgrade apr-util-ldapUpgrade apr-util-develUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-bdbUpgrade apr-util-opensslUpgrade apr-util-debugsourceUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-odbc-debuginfoUpgrade apr-utilUpgrade apr-util-ldap-debuginfoUpgrade apr-util-debuginfoUpgrade apr-util-mysql-debuginfoUpgrade apr-util-lmdbUpgrade apr-util-sqliteUpgrade apr-util-odbc | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade libaprutil1 (Ubuntu Pro)Upgrade libaprutil1Upgrade libaprutil1t64 | Sep 14, 2026 | Sep 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub