Uncontrolled Recursion in Apache APR-util - CVE-2026-32327

Vulnerability identifier: #VU144927

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-32327

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in apr_xml_quote_elem() when parsing XML from untrusted sources. A remote attacker can supply crafted XML input to cause a denial of service.

The issue affects library consumers that parse XML from untrusted sources and use the vulnerable function.

Apache APR-util
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Ubuntu
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
Fedora
apr-util (Ubuntu package)
libapr-util1-dbd-sqlite3-debuginfo
libapr-util1-debuginfo
libapr-util1-dbd-sqlite3
libapr-util1-debugsource
libapr-util1-devel
libapr-util1
apr-util-debuginfo
apr-util-pgsql
apr-util-devel
apr-util
apr-util-debugsource
apr-util-odbc
apr-util (Red Hat package)
libapr-util1-dbm-db
libapr-util1-dbm-db-debuginfo
libapr-util1-dbd-mysql-debuginfo
libapr-util1-dbd-pgsql
libapr-util1-dbd-pgsql-debuginfo
libapr-util1-dbd-mysql
apr-util (Debian package)
apr-util-ldap
apr-util-mysql
apr-util-openssl
apr-util-sqlite
apr-util-doc

Install security update from vendor's website.

Apache APR-util - update to 1.6.4
apr-util (Ubuntu package) - addressed in versions 1.5.3-1ubuntu0.1~esm3, 1.5.4-1ubuntu0.1~esm1, 1.6.1-2ubuntu0.1+esm1, 1.6.1-4ubuntu2.2+esm1, 1.6.1-5ubuntu4.22.04.3, 1.6.3-1.1ubuntu7.1, 1.6.3-3ubuntu3.1
libapr-util1-dbd-sqlite3-debuginfo - addressed in versions 1.5.3-8.22.1, 1.5.3-8.34.1, 1.5.3-8.36.1, 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-debuginfo - addressed in versions 1.5.3-8.22.1, 1.5.3-8.34.1, 1.5.3-8.36.1, 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-dbd-sqlite3 - addressed in versions 1.5.3-8.22.1, 1.5.3-8.34.1, 1.5.3-8.36.1, 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-debugsource - addressed in versions 1.5.3-8.22.1, 1.5.3-8.34.1, 1.5.3-8.36.1
libapr-util1-devel - addressed in versions 1.5.3-8.22.1, 1.5.3-8.34.1, 1.5.3-8.36.1
libapr-util1 - addressed in versions 1.5.3-8.22.1, 1.5.3-8.34.1, 1.5.3-8.36.1, 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
apr-util-debuginfo - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-pgsql - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-devel - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debugsource - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-odbc - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util (Red Hat package) - addressed in versions 1.6.1-23.el9_8.1, 1.6.3-23.el10_2.1
libapr-util1-dbm-db - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-dbm-db-debuginfo - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-dbd-mysql-debuginfo - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-dbd-pgsql - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-dbd-pgsql-debuginfo - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
apr-util-devel - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
libapr-util1-dbd-mysql - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
apr-util-debuginfo - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
apr-util-debugsource - addressed in versions 1.6.1-150300.18.8.1, 1.6.1-150600.27.3.1
apr-util (Debian package) - update to 1.6.3-3+deb13u1
apr-util - update to 1.6.3-4
apr-util-devel - update to 1.6.3-4
apr-util-ldap - update to 1.6.3-4
apr-util-mysql - update to 1.6.3-4
apr-util-odbc - update to 1.6.3-4
apr-util-openssl - update to 1.6.3-4
apr-util-pgsql - update to 1.6.3-4
apr-util-sqlite - update to 1.6.3-4
apr-util-doc - update to 1.6.3-4
apr-util - addressed in versions 1.6.5-1.fc43, 1.6.5-1.fc44

• https://lists.apache.org/api/email.lua?id=x6m1l5qk5wd5yhrsf1q6v8jdb5j2w4tx
• https://apr.apache.org/

• Multiple vulnerabilities in Apache APR-util
• Debian update for apr-util
• Fedora 44 update for apr-util
• Fedora 43 update for apr-util
• openEuler 24.03 LTS SP3 update for apr-util
• openEuler 24.03 LTS SP1 update for apr-util
• openEuler 22.03 LTS SP4 update for apr-util
• openEuler 20.03 LTS SP4 update for apr-util
• openEuler 24.03 LTS SP4 update for apr-util
• SUSE update for libapr-util1
• SUSE update for apr-util
• SUSE update for apr-util
• Ubuntu update for apr-util
• Red Hat Enterprise Linux 9 update for apr-util
• Red Hat Enterprise Linux 10 update for apr-util
• Anolis OS update for apr-util