Debian/apr-util: critical 9.1
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are
Action: Upgrade apr-util to 1.6.3-3+deb13u1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.6.3-3+deb13u1 | - |
Fixed versions
| 1.6.3-3+deb13u1 |
Sources
- osv: DEBIAN-CVE-2026-32327#Debian:13/apr-util
- https://security-tracker.debian.org/tracker/CVE-2026-32327
published · modified · JSON