Apache Apr-Util vulnerabilities

11 CVEs affecting Apache Apr-Util, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-34502, published 2026-08-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2009-1955, published 2009-06-08. High severity, CVSS 7.5. EPSS: 53% chance of exploitation in the next 30 days. The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to…
CVE-2010-1623, published 2010-10-04. Medium severity, CVSS 5.0. EPSS: 20.3% chance of exploitation in the next 30 days. Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache Portable Runtime Utility library (aka APR-util) before 1.3.10, as used in the mod_reqtimeout module in the…
CVE-2009-2412, published 2009-08-06. High severity, CVSS 10.0. EPSS: 13.8% chance of exploitation in the next 30 days. Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service…
CVE-2009-1956, published 2009-06-08. Medium severity, CVSS 6.4. EPSS: 12% chance of exploitation in the next 30 days. Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on big-endian platforms allows remote attackers to obtain sensitive information or cause a denial of service…
CVE-2011-1928, published 2011-05-24. Medium severity, CVSS 4.3. EPSS: 10.3% chance of exploitation in the next 30 days. The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service…
CVE-2009-0023, published 2009-06-08. Medium severity, CVSS 4.3. EPSS: 8.5% chance of exploitation in the next 30 days. The apr_strmatch_precompile function in strmatch/apr_strmatch.c in Apache APR-util before 1.3.5 allows remote attackers to cause a denial of service (daemon crash) via crafted input involving (1) a…
CVE-2026-34191, published 2026-08-06. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable…
CVE-2026-34502, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
CVE-2026-34501, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to…
CVE-2026-32327, published 2026-08-06. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users…

Latest

CVE-2025-49506, published 2026-08-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel…