CVE-2026-32327 PUBLISHED

Apache Portable Runtime Utility: apr-util XML stack recursion crash

Assigner: apache
Reserved: 12.03.2026 Published: 06.08.2026 Updated: 06.08.2026

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Product Status

Vendor Apache Software Foundation
Product Apache Portable Runtime Utility
Versions Default: unaffected
  • affected from 0 to 1.6.3 (incl.)

Credits

  • Younghyo Cho @ CISLab, SeoulTech finder
  • 4ra1n, pyn3rd and unam4 finder

References

Problem Types

  • CWE-674 Uncontrolled Recursion CWE