CVE Intelligence

Vulnerabilidades do Apache Software Foundation Apr-util

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Apache Software Foundation Apr-util: 5 registro(s), com versões afetadas e correções.
cpe:2.3:a:apache:apr-util

CVE-2026-34502 Alta · 7.5 CWE-122 06/08/2026
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
CVE-2026-34501 Alta · 7.5 CWE-122 06/08/2026
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
CVE-2026-34191 Crítica · 9.1 CWE-89 06/08/2026
Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
CVE-2026-32327 Crítica · 9.1 CWE-674 06/08/2026
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
CVE-2025-49506 Alta · 7.5 CWE-208 06/08/2026
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.