CVE-2026-32327 - Vulnerability Details - OpenCVE

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Apache	Portable Runtime Utility

No data.

No data.

References

Link	Providers
https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1

History

Thu, 06 Aug 2026 18:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 06 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache portable Runtime Utility
Vendors & Products		Apache Apache portable Runtime Utility

Thu, 06 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Title		Apache Portable Runtime Utility: apr-util XML stack recursion crash
Weaknesses		CWE-674
References		https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2026-08-06T14:32:43.526Z

Updated: 2026-08-06T21:56:07.488Z

Reserved: 2026-03-12T08:57:52.096Z

Link: CVE-2026-32327

Vulnrichment

Updated: 2026-08-06T21:56:07.488Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32327", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-12T08:57:52.096Z", "datePublished": "2026-08-06T14:32:43.526Z", "dateUpdated": "2026-08-06T21:56:07.488Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "APR-util", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Younghyo Cho @ CISLab, SeoulTech"}, {"lang": "en", "type": "finder", "value": "4ra1n, pyn3rd and unam4"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.<br><br>Users are recommended to upgrade to version 1.6.4, which fixes this issue."}], "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the\u00a0apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:32:43.526Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-03-07T07:11:00.000Z", "value": "Report received"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936815"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "title": "Apache Portable Runtime Utility: apr-util XML stack recursion crash", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T17:46:05.943190Z", "id": "CVE-2026-32327", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T17:46:13.272Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:07.488Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/9"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:07.488Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-32327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T17:46:05.943190Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T17:45:55.935Z"}}], "cna": {"title": "Apache Portable Runtime Utility: apr-util XML stack recursion crash", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Younghyo Cho @ CISLab, SeoulTech"}, {"lang": "en", "type": "finder", "value": "4ra1n, pyn3rd and unam4"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Portable Runtime Utility", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "packageName": "APR-util", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-07T07:11:00.000Z", "value": "Report received"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936815"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "references": [{"url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the\u00a0apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.<br><br>Users are recommended to upgrade to version 1.6.4, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:32:43.526Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32327", "state": "PUBLISHED", "dateUpdated": "2026-08-06T21:56:07.488Z", "dateReserved": "2026-03-12T08:57:52.096Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-06T14:32:43.526Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}