apr-util stack recursion in XML parsing, fixed in 1.6.4
CVE-2026-32327 Published on August 6, 2026
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Timeline
Report received
fixed in 1.6.x by r1936815 152 days later.
1.6.4 released
Weakness Type
What is a Stack Exhaustion Vulnerability?
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CVE-2026-32327 has been classified to as a Stack Exhaustion vulnerability or weakness.
Affected Versions
Apache Software Foundation Apache Portable Runtime Utility:- Before and including 1.6.3 is affected.