Описание
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
A flaw was found in Apache Portable Runtime Utility (apr-util). A remote attacker could exploit a stack recursion vulnerability by providing specially crafted XML input to a library consumer that uses the apr_xml_quote_elem() function. This could lead to a denial of service (DoS) due to an application crash.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | apr-util | Fix deferred | ||
| Red Hat Enterprise Linux 7 | apr-util | Fix deferred | ||
| Red Hat Enterprise Linux 10 | apr-util | Fixed | RHSA-2026:66392 | 10.09.2026 |
| Red Hat Enterprise Linux 8 | apr-util | Fixed | RHSA-2026:69113 | 21.09.2026 |
| Red Hat Enterprise Linux 9 | apr-util | Fixed | RHSA-2026:66341 | 10.09.2026 |
| Red Hat Hardened Images | apr-util-main-1.6.5-1.hum1 | Fixed | RHSA-2026:58474 | 22.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
6.2 Medium
CVSS3
Связанные уязвимости
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion ...
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
EPSS
6.2 Medium
CVSS3