CVE-2026-32327: Apache Portable Runtime Utility: apr-util XML stack recursion crash

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-10-24
Weakness: CWE-674

Description

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Affected products

Apache Apr-Util: before 1.6.4 — fixed in 1.6.4

How to fix

Upgrade to a fixed version: Apache Apr-Util 1.6.4. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1
http://www.openwall.com/lists/oss-security/2026/08/06/9

Get alerted when CVE-2026-32327 or the next vulnerability affects your stack