rpm package
almalinux/apr-util-pgsql
pkg:rpm/almalinux/apr-util-pgsql
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-34502 | Hig | 7.5 | < 1.6.1-23.el9_8.1 | 1.6.1-23.el9_8.1 | Aug 6, 2026 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3. | |
| CVE-2026-34501 | Hig | 7.5 | < 1.6.1-23.el9_8.1 | 1.6.1-23.el9_8.1 | Aug 6, 2026 | Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue. | |
| CVE-2026-32327 | Cri | 9.1 | < 1.6.1-23.el9_8.1 | 1.6.1-23.el9_8.1 | Aug 6, 2026 | A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue. | |
| CVE-2025-49506 | Hig | 7.5 | < 1.6.1-23.el9_8.1 | 1.6.1-23.el9_8.1 | Aug 6, 2026 | APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWa | |
| CVE-2022-25147 | Med | 6.5 | < 1.6.1-6.el8_8.1 | 1.6.1-6.el8_8.1 | Jan 31, 2023 | Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions. |
- affected < 1.6.1-23.el9_8.1fixed 1.6.1-23.el9_8.1
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
- affected < 1.6.1-23.el9_8.1fixed 1.6.1-23.el9_8.1
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
- affected < 1.6.1-23.el9_8.1fixed 1.6.1-23.el9_8.1
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
- affected < 1.6.1-23.el9_8.1fixed 1.6.1-23.el9_8.1
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWa
- affected < 1.6.1-6.el8_8.1fixed 1.6.1-6.el8_8.1
Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.