Apache Portable Runtime (APR) security advisories

Security information for Apache Portable Runtime (APR)

Reporting

Do you want disclose a potential security issue for Apache Portable Runtime (APR)? Send your report to the Apache Security Team.

You can read more about the security policy on:

Advisories

This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the project security page linked above. If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public mailinglist or privately on security@apache.org

Heap buffer overflow in APR memcached client

CVE-2026-34502 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-06T14:31:06.399Z

Affected

  • Apache Portable Runtime Utility from 1.3.0 through 1.6.3

Description

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

References

Credits

  • Elhanan Haenel (finder)

Heap buffer overflow in APR redis client

CVE-2026-34501 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-06T14:31:46.904Z

Affected

  • Apache Portable Runtime Utility from 1.6.0 through 1.6.3

Description

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.

References

Credits

  • Elhanan Haenel (finder)

SQL Injection in apr_dbd_oracle

CVE-2026-34191 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-06T14:32:23.055Z

Affected

  • Apache Portable Runtime Utility from 1.6.0 through 1.6.3

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

References

Credits

  • Elhanan Haenel (finder)

apr-util XML stack recursion crash

CVE-2026-32327 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-06T14:32:41.688Z

Affected

  • Apache Portable Runtime Utility through 1.6.3

Description

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

References

Credits

  • Younghyo Cho @ CISLab, SeoulTech (finder)
  • 4ra1n, pyn3rd and unam4 (finder)

apr_password_validate() vulnerable to timing attack

CVE-2025-49506 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-06T14:33:11.589Z

Affected

  • Apache Portable Runtime Utility from 1.2.0 through 1.6.3

Description

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.

References

Credits

  • Michael Rowley (finder)

Unexpected lax shared memory permissions

CVE-2023-49582 [CVE] [CVE json] [OSV json]

Last updated: 2026-08-06T13:47:55.389Z

Affected

  • Apache Portable Runtime (APR) from 0.9.0 through 1.7.4

Description

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

References

Credits

  • Thomas Stangner (reporter)

Windows out-of-bounds write in apr_socket_sendv function

CVE-2022-28331 [CVE] [CVE json] [OSV json]

Last updated: 2023-07-07T15:26:37.824Z

Affected

  • Apache Portable Runtime (APR) through 1.7.0

Description

On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.

References

Credits

  • Ronald Crane (Zippenhop LLC) (finder)

out-of-bounds writes in the apr_base64 family of functions

CVE-2022-25147 [CVE] [CVE json] [OSV json]

Last updated: 2023-01-31T15:54:46.758Z

Affected

  • Apache Portable Runtime Utility (APR-util) through 1.6.1

Description

Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer.

This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.

References

Credits

  • Ronald Crane (Zippenhop LLC) (reporter)

out-of-bound writes in the apr_encode family of functions

CVE-2022-24963 [CVE] [CVE json] [OSV json]

Last updated: 2023-01-31T15:51:53.920Z

Affected

  • Apache Portable Runtime (APR) at 1.7.0

Description

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.
This issue affects Apache Portable Runtime (APR) version 1.7.0.

References

Credits

  • Ronald Crane (Zippenhop LLC) (finder)

Regression of CVE-2017-12613

CVE-2021-35940 [CVE] [CVE json] [OSV json]

Last updated: 2021-10-11T14:15:55.651Z

Affected

  • Apache Portable Runtime (APR) at Apache Portable Runtime 1.7.0

Description

An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.

References

Credits

  • The Apache Portable Runtime project would like to thank Iveta Cesalova (Red Hat) for reporting this issue.