Stack Recursion Vulnerability in APR-util Affects Apache Software Foundation
CVE-2026-32327

9.1CRITICAL

Key Information:

Vendor

Apache
Status
Apache Portable Runtime Utility
Vendor
CVE Published:
6 August 2026

What is CVE-2026-32327?

A stack recursion vulnerability in APR-util versions prior to 1.6.4 can be exploited by parsing XML from untrusted sources. When libraries utilize the apr_xml_quote_elem() function, attackers could cause a stack overflow, leading to potential denial of service or arbitrary code execution. Users are strongly advised to upgrade to version 1.6.4 or later to mitigate this risk effectively.

Affected Version(s)

Apache Portable Runtime Utility 0 <= 1.6.3

References

https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksf...
vendor-advisory

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Younghyo Cho @ CISLab, SeoulTech
4ra1n, pyn3rd and unam4
.