Apache APR is vulnerable to a denial of service, caused by insufficient randomization of hash data structures. By sending multiple specially-crafted HTTP POST requests to an affected application containing conflicting hash key values, a remote attacker could exploit this vulnerability to cause the consumption of CPU resources.

Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache Portable Utility library (aka APR-util) 0.9.x and 1.3.x allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger crafted calls to the (1) allocatoralloc or (2) aprpalloc function in memory/unix/aprpools.c in APR; or crafted calls to the (3) aprrmmmalloc, (4) aprrmmcalloc, or (5) aprrmmrealloc function in misc/aprrmm.c in APR-util; leading to buffer overflows. NOTE: some of these details are obtained from third party information.