Stack Recursion Vulnerability in APR-util Affects Apache Software Foundation
CVE-2026-32327

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Portable Runtime Utility
Vendor
CVE Published:
6 August 2026

What is CVE-2026-32327?

A stack recursion vulnerability in APR-util versions prior to 1.6.4 can be exploited by parsing XML from untrusted sources. When libraries utilize the apr_xml_quote_elem() function, attackers could cause a stack overflow, leading to potential denial of service or arbitrary code execution. Users are strongly advised to upgrade to version 1.6.4 or later to mitigate this risk effectively.

Affected Version(s)

Apache Portable Runtime Utility 0 <= 1.6.3

References

https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksf...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Younghyo Cho @ CISLab, SeoulTech
4ra1n, pyn3rd and unam4
.