A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apr-util | Aug 10, 2026 | Aug 6, 2026 |
| Amazon_linux_2023 | — | Upgrade apr-util-pgsql-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-develUpgrade apr-util-mysqlUpgrade apr-util-ldapUpgrade apr-util-openssl-debuginfoUpgrade apr-utilUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-debugsourceUpgrade apr-util-odbc-debuginfoUpgrade apr-util-pgsqlUpgrade apr-util-ldap-debuginfoUpgrade apr-util-opensslUpgrade apr-util-lmdbUpgrade apr-util-odbcUpgrade apr-util-mysql-debuginfoUpgrade apr-util-sqliteUpgrade apr-util-debuginfo | Sep 1, 2026 | Aug 6, 2026 |
| Debian | — | Upgrade apr-util | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | Upgrade apr-util-pgsql-debuginfoUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-mysql-debuginfoUpgrade apr-util-opensslUpgrade apr-util-ldapUpgrade apr-util-bdb-debuginfoUpgrade apr-util-ldap-debuginfoUpgrade apr-util-lmdbUpgrade apr-util-develUpgrade apr-util-odbc-debuginfoUpgrade apr-util-openssl-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-odbcUpgrade apr-util-sqliteUpgrade apr-util-mysqlUpgrade apr-util-pgsqlNo solution existsUpgrade apr-util-debugsourceUpgrade apr-utilUpgrade apr-util-debuginfoUpgrade apr-util-bdb | Aug 12, 2026 | Aug 6, 2026 |
| Rocky_linux | — | Upgrade apr-util-lmdbUpgrade apr-util-odbcUpgrade apr-util-sqliteUpgrade apr-util-mysql-debuginfoUpgrade apr-util-debuginfoUpgrade apr-util-openssl-debuginfoUpgrade apr-util-bdb-debuginfoUpgrade apr-util-bdbUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-ldapUpgrade apr-util-mysqlUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-ldap-debuginfoUpgrade apr-utilUpgrade apr-util-odbc-debuginfoUpgrade apr-util-opensslUpgrade apr-util-pgsqlUpgrade apr-util-develUpgrade apr-util-debugsource | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade libaprutil1 (Ubuntu Pro)Upgrade libaprutil1Upgrade libaprutil1t64 | Sep 14, 2026 | Sep 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub