Apr-util (Apache) - vulnerabilities (CVEs)
11 CVEs, 0 in the last 30 days, 116 known versions, newest CVE from 2026-08-06. Vendor: Apache.
CVEs of Apr-util
- CVE-2025-49506 - CVSS 7.5 (high), 2026-08-06: APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially…
- CVE-2026-32327 - CVSS 9.1 (critical), 2026-08-06: A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses…
- CVE-2026-34191 - CVSS 9.1 (critical), 2026-08-06: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle…
- CVE-2026-34501 - CVSS 7.5 (high), 2026-08-06: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0…
- CVE-2026-34502 - CVSS 7.5 (high), 2026-08-06: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0…
- CVE-2011-1928 - CVSS 4.3 (medium), 2011-05-24: The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote…
- CVE-2010-1623 - CVSS 5 (medium), 2010-10-04: Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as…
- CVE-2009-2412 - CVSS 10 (critical), 2009-08-06: Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote…
- CVE-2009-0023 - CVSS 4.3 (medium), 2009-06-08: The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon…
- CVE-2009-1956 - CVSS 6.4 (medium), 2009-06-08: Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive…
- CVE-2009-1955 - CVSS 7.5 (high), 2009-06-08: The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache…
