CVE-2026-32327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32327", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-12T08:57:52.096Z", "datePublished": "2026-08-06T14:32:43.526Z", "dateUpdated": "2026-08-06T21:56:07.488Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "APR-util", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Younghyo Cho @ CISLab, SeoulTech"}, {"lang": "en", "type": "finder", "value": "4ra1n, pyn3rd and unam4"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the&nbsp;apr_xml_quote_elem() function.<br><br>Users are recommended to upgrade to version 1.6.4, which fixes this issue."}], "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the\u00a0apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:32:43.526Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-03-07T07:11:00.000Z", "value": "Report received"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936815"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "title": "Apache Portable Runtime Utility: apr-util XML stack recursion crash", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T17:46:05.943190Z", "id": "CVE-2026-32327", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T17:46:13.272Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:07.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:07.488Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T17:46:05.943190Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T17:45:55.935Z"}}], "cna": {"title": "Apache Portable Runtime Utility: apr-util XML stack recursion crash", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Younghyo Cho @ CISLab, SeoulTech"}, {"lang": "en", "type": "finder", "value": "4ra1n, pyn3rd and unam4"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Portable Runtime Utility", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "packageName": "APR-util", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-07T07:11:00.000Z", "value": "Report received"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936815"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "references": [{"url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the\u00a0apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the&nbsp;apr_xml_quote_elem() function.<br><br>Users are recommended to upgrade to version 1.6.4, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:32:43.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32327", "state": "PUBLISHED", "dateUpdated": "2026-08-06T21:56:07.488Z", "dateReserved": "2026-03-12T08:57:52.096Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-06T14:32:43.526Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "APR-util", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*", "matchCriteriaId": "92873888-3F9F-45E0-930E-D06B5648DC2C", "versionEndExcluding": "1.6.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the\u00a0apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}, {"lang": "es", "value": "Un error en APR-util versi\u00f3n 1.6.3 (y anteriores) permite un ataque de recursi\u00f3n de pila contra cualquier consumidor de biblioteca que analiza XML de fuentes no confiables y utiliza la funci\u00f3n apr_xml_quote_elem().\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.6.4, que corrige este problema."}], "id": "CVE-2026-32327", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32327", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T17:46:05.943190Z", "version": "2.0.3"}}]}, "published": "2026-08-06T15:16:54.190", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/08/06/9"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "apr-util: APR-util: Denial of Service via XML stack recursion attack", "id": "2512079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512079"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.2", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-776", "details": ["A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the\u00a0apr_xml_quote_elem() function.\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.", "A flaw was found in APR-util. A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the `apr_xml_quote_elem()` function. This could lead to a denial of service (DoS) due to an application crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-32327", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-06T14:32:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32327\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32327\nhttps://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Portable Runtime Utility", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "portable_runtime_utility", "vendor": "apache"}], "created": "2026-08-06T16:00:06.568898+00:00", "updated": "2026-08-11T02:45:06.179625+00:00", "vendors": ["apache", "apache$PRODUCT$portable_runtime_utility"]}