Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11

Export CSV
CVE-2026-34502

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2026-34501

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2026-34191

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2025-49506

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2026-32327

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2009-0023

apr-util heap buffer underwrite

The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a .htaccess file used with the Apache HTTP Server, (2) the SVNMasterURI directive in the mod_dav_svn module in the Apache HTTP Server, (3) the mod_apreq2 module for the Apache HTTP Server, or (4) an application that uses the libapreq2 library, which triggers a heap-based buffer underflow.

CVSS 2.0 · 4.3 Medium EPSS 8.5% KEV · Not listed
Vendors
Apache Redhat
Products
Apr-util Http Server Certificate System and 2 more
CVE-2009-1955

apr-util billion laughs attack

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

CVSS 3.1 · 7.5 High EPSS 53.0% KEV · Not listed
Vendors
Apache Apple Canonical and 5 more
Products
Apr-util Http Server Mac Os X and 8 more
CVE-2009-1956

apr-util single NULL byte buffer overflow

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.

CVSS 2.0 · 6.4 Medium EPSS 12.0% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Apr-util Http Server Ubuntu Linux and 2 more
CVE-2009-2412

apr-util: Integer overflows in memory pool (apr) and relocatable memory (apr-util) management

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocator_alloc or (2) apr_palloc function in memory/unix/apr_pools.c in APR; or crafted calls to the (3) apr_rmm_malloc, (4) apr_rmm_calloc, or (5) apr_rmm_realloc function in misc/apr_rmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 10.0 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Redhat
Products
Apr-util Portable Runtime Certificate System and 2 more
CVE-2011-1928

apr: DoS flaw in apr_fnmatch() due to fix for CVE-2011-0419

The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used. NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.

CVSS 2.0 · 4.3 Medium EPSS 10.3% KEV · Not listed
Vendors
Apache Redhat
Products
Apr-util Http Server Enterprise Linux
CVE-2010-1623

apr-util: high memory consumption in apr_brigade_split_line()

Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the Apache HTTP Server and other software, allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors related to the destruction of an APR bucket.

CVSS 2.0 · 5.0 Medium EPSS 20.3% KEV · Not listed
Vendors
Apache Redhat
Products
Apr-util Http Server Enterprise Linux and 1 more