CVE catalog

CVE-2026-32327

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users ar

[CVE catalog]

Severity
Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.46% · Oct 25, 2026

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianapr-utilsid1.6.4-2fixed
Debianapr-utilforky1.6.4-2fixed
Debianapr-utiltrixie1.6.3-3+deb13u1fixed
Debianapr-utiltrixie-security1.6.3-3+deb13u1fixed
Debianapr-utilbookworm1.6.3-1vulnerable
Debianapr-utilbookworm-security1.6.3-1+deb12u1fixed
Ubuntuapr-utilnoble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1-dbd-mysqlnoble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1-dbd-odbcnoble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1-dbd-pgsqlnoble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1-dbd-sqlite3noble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1-devnoble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1-ldapnoble1.6.3-1.1ubuntu7.1fixed
Ubuntulibaprutil1t64noble1.6.3-1.1ubuntu7.1fixed
Alpineapr-util3.211.6.4-r0fixed
Alpineapr-util3.221.6.4-r0fixed
Alpineapr-util3.231.6.4-r0fixed
Alpineapr-util3.241.6.4-r0fixed
Ubuntuapr-utilpro1.6.1-4build1vulnerable
Ubuntuapr-utilpro1.6.1-4ubuntu1vulnerable
Ubuntuapr-utilpro1.6.1-4ubuntu2vulnerable
Ubuntuapr-utilpro1.6.1-4ubuntu2.1vulnerable
Ubuntuapr-utilpro1.6.1-4ubuntu2.2vulnerable
Ubuntuapr-utilpro1.6.1-4ubuntu2.2+esm1fixed
Ubuntuapr-util22.041.6.1-5ubuntu2vulnerable
Ubuntuapr-util22.041.6.1-5ubuntu3vulnerable
Ubuntuapr-util22.041.6.1-5ubuntu4vulnerable
Ubuntuapr-util22.041.6.1-5ubuntu4.22.04.1vulnerable
Ubuntuapr-util22.041.6.1-5ubuntu4.22.04.2vulnerable
Ubuntuapr-util22.041.6.1-5ubuntu4.22.04.3fixed
Ubuntuapr-util24.041.6.3-1ubuntu1vulnerable
Ubuntuapr-util24.041.6.3-1.1ubuntu5vulnerable
Ubuntuapr-util24.041.6.3-1.1ubuntu6vulnerable
Ubuntuapr-util24.041.6.3-1.1ubuntu7vulnerable
Ubuntuapr-util24.041.6.3-1.1ubuntu7.1fixed
Ubuntuapr-util26.041.6.3-3ubuntu2vulnerable
Ubuntuapr-util26.041.6.3-3ubuntu3vulnerable
Ubuntuapr-util26.041.6.3-3ubuntu3.1fixed
Cpeapr-utilNot reported1.6.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianapr-utilsourcesid1.6.4-1not yet assignedNot reported[1143837]
Debianapr-utilsourceforky1.6.4-1not yet assignedNot reported[1143837]
Debianapr-utilsourcetrixie1.6.3-3+deb13u1not yet assignedNot reported[1143837]
Debianapr-utilsourcebookworm1.6.3-1+deb12u1not yet assignedNot reported[1143837]
Ubuntuapr-utildebnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1-dbd-mysqldebnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1-dbd-odbcdebnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1-dbd-pgsqldebnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1-dbd-sqlite3debnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1-devdebnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1-ldapdebnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Ubuntulibaprutil1t64debnoble1.6.3-1.1ubuntu7.1Not reportedNot reportedNot reported
Alpineapr-utilapk3.211.6.4-r0Not reportedALPINE-CVE-2026-32327Not reported
Alpineapr-utilapk3.221.6.4-r0Not reportedALPINE-CVE-2026-32327Not reported
Alpineapr-utilapk3.231.6.4-r0Not reportedALPINE-CVE-2026-32327Not reported
Alpineapr-utilapk3.241.6.4-r0Not reportedALPINE-CVE-2026-32327Not reported
Ubuntuapr-utildebpro1.6.1-4ubuntu2.2+esm1Not reportedUBUNTU-CVE-2026-32327Not reported
Ubuntuapr-utildeb22.041.6.1-5ubuntu4.22.04.3Not reportedUBUNTU-CVE-2026-32327Not reported
Ubuntuapr-utildeb24.041.6.3-1.1ubuntu7.1Not reportedUBUNTU-CVE-2026-32327Not reported
Ubuntuapr-utildeb26.041.6.3-3ubuntu3.1Not reportedUBUNTU-CVE-2026-32327Not reported
Cpeapr-utilcpeNot reported1.6.4Not reportedNVD-CVE-2026-32327Not reported

[Debian bug #1143837]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libaprutil1]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

  • [libaprutil1-dbd-mysql]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

  • [libaprutil1-dbd-odbc]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

  • [libaprutil1-dbd-pgsql]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

  • [libaprutil1-dbd-sqlite3]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

  • [libaprutil1-dev]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

  • [libaprutil1-ldap]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-1 · amd64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1 · arm64 · bookworm

      Affected · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · amd64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

    • 1.6.3-1+deb12u1 · arm64 · bookworm-security

      Fixed · Fixed: 1.6.3-1+deb12u1

      nvd · apr-util · debian · bookworm; nvd · apr-util · debian · 12

[Debian 13 (Trixie)]

  • [libaprutil1-dbd-mysql]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

  • [libaprutil1-dbd-odbc]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

  • [libaprutil1-dbd-pgsql]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

  • [libaprutil1-dbd-sqlite3]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

  • [libaprutil1-dev]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

  • [libaprutil1-ldap]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

  • [libaprutil1t64]Affected

    Source package: [apr-util]

    Details (4)

    • 1.6.3-3+b1 · amd64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+b1 · arm64 · trixie

      Affected · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

    • 1.6.3-3+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.6.3-3+deb13u1

      nvd · apr-util · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]