Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-34502

Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2026-34501

Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2026-34191

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2025-49506

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2026-32327

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Apr-util Portable Runtime Utility
CVE-2017-12618

apr-util: Out-of-bounds access in corrupted SDBM database

Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm*() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Portable Runtime Utility
CVE-2022-25147

Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Apache Redhat
Products
Portable Runtime Utility Enterprise Linux Jboss Core Services and 4 more