Paper/Archive/CVE-2026-32327

CVE-2026-32327

Apache Software Foundation Apache Portable Runtime Utility — Apache Portable Runtime Utility: apr-util XML stack recursion crash

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 39.8.398 × 208.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Affected

ProductAffectedFixed inSource

Apache Portable Runtime Utility≤ 1.6.3–CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorylists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1 refopenwall.com/lists/oss-security/2026/08/06/9