CVE-2009-1956: Apache Apr-Util

Medium severity, CVSS 6.4. EPSS: 12% chance of exploitation in the next 30 days.

Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service (application crash) via crafted input.

Affected products

• Apache Apr-Util: up to and including 1.3.4
• Apache HTTP Server: from 2.2.0, before 2.2.12 (fixed in 2.2.12)
• Canonical Ubuntu Linux: version 6.06 only; version 8.04 only; version 8.10 only; version 9.04 only

Published 2009-06-08. Last modified 2026-06-16.