Apache Portable Runtime Utility (Apache Software Foundation) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-08-06. Vendor: Apache Software Foundation.

CVEs of Apache Portable Runtime Utility

• CVE-2025-49506 - CVSS 7.5 (high), 2026-08-06: APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially…
• CVE-2026-32327 - CVSS 9.1 (critical), 2026-08-06: A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses…
• CVE-2026-34191 - CVSS 9.1 (critical), 2026-08-06: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle…
• CVE-2026-34501 - CVSS 7.5 (high), 2026-08-06: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0…
• CVE-2026-34502 - CVSS 7.5 (high), 2026-08-06: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0…