Uncontrolled Recursion in Apache APR-util - CVE-2026-32327

Vulnerability identifier: #VU144927

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-32327

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in apr_xml_quote_elem() when parsing XML from untrusted sources. A remote attacker can supply crafted XML input to cause a denial of service.

The issue affects library consumers that parse XML from untrusted sources and use the vulnerable function.

Apache APR-util
Debian Linux
openEuler
Fedora
apr-util-pgsql
apr-util-odbc
apr-util-devel
apr-util-debugsource
apr-util-debuginfo
apr-util
apr-util (Debian package)

Install security update from vendor's website.

Apache APR-util - update to 1.6.4
apr-util-pgsql - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-odbc - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-devel - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debugsource - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debuginfo - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util (Debian package) - update to 1.6.3-3+deb13u1
apr-util - addressed in versions 1.6.5-1.fc43, 1.6.5-1.fc44

• https://lists.apache.org/api/email.lua?id=x6m1l5qk5wd5yhrsf1q6v8jdb5j2w4tx
• https://apr.apache.org/

• Multiple vulnerabilities in Apache APR-util
• Debian update for apr-util
• Fedora 44 update for apr-util
• Fedora 43 update for apr-util
• openEuler 24.03 LTS SP3 update for apr-util
• openEuler 24.03 LTS SP1 update for apr-util
• openEuler 22.03 LTS SP4 update for apr-util
• openEuler 20.03 LTS SP4 update for apr-util
• openEuler 24.03 LTS SP4 update for apr-util