CVE-2026-32327: Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem() function.
Other sources
Apache Portable Runtime Utility: apr-util XML stack recursion crash
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.3-3 - Upgrade
Upgrade
debian/apr-utilto a version that resolves this vulnerability.Fixed in 1.6.3-1+deb12u1Fixed in 1.6.3-3+deb13u1Fixed in 1.6.4-2 - Upgrade
Upgrade
Apache Portable Runtime Utility (apr-util)to a version that resolves this vulnerability.Fixed in 1.6.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32327?
The severity of CVE-2026-32327 is rated at risk level 23.
How do I fix CVE-2026-32327?
To fix CVE-2026-32327, upgrade to Apache APR-util version 1.6.4 or later.
What does CVE-2026-32327 affect?
CVE-2026-32327 affects libraries that use the apr_xml_quote_elem() function to parse XML from untrusted sources.
What is the cause of CVE-2026-32327?
CVE-2026-32327 is caused by a bug in APR-util that allows a stack recursion attack when parsing XML.
Which versions are vulnerable to CVE-2026-32327?
APR-util version 1.6.3 and earlier are vulnerable to CVE-2026-32327.