RHSA-2026:69113MediumCVSS 7.5

Red Hat Security Advisory: apr-util security update

Published
September 21, 2026
Last Modified
September 21, 2026

🔗 CVE IDs covered (4)

CVE-2025-49506 →CVE-2026-32327 →CVE-2026-34501 →CVE-2026-34502 →

📋 Description

CVE-2025-49506 — apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2026-32327 — apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack CVE-2026-34501 — apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client CVE-2026-34502 — apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

🎯 Affected products87

  • Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-0:1.6.1-9.el8_10.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-0:1.6.1-9.el8_10.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-0:1.6.1-9.el8_10.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-0:1.6.1-9.el8_10.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-0:1.6.1-9.el8_10.1.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-0:1.6.1-9.el8_10.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-0:1.6.1-9.el8_10.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-0:1.6.1-9.el8_10.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-0:1.6.1-9.el8_10.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-0:1.6.1-9.el8_10.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-0:1.6.1-9.el8_10.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-debuginfo-0:1.6.1-9.el8_10.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-debuginfo-0:1.6.1-9.el8_10.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-debuginfo-0:1.6.1-9.el8_10.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-debuginfo-0:1.6.1-9.el8_10.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-bdb-debuginfo-0:1.6.1-9.el8_10.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debuginfo-0:1.6.1-9.el8_10.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debuginfo-0:1.6.1-9.el8_10.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debuginfo-0:1.6.1-9.el8_10.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debuginfo-0:1.6.1-9.el8_10.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debuginfo-0:1.6.1-9.el8_10.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debugsource-0:1.6.1-9.el8_10.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debugsource-0:1.6.1-9.el8_10.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debugsource-0:1.6.1-9.el8_10.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debugsource-0:1.6.1-9.el8_10.1.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-debugsource-0:1.6.1-9.el8_10.1.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-devel-0:1.6.1-9.el8_10.1.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-devel-0:1.6.1-9.el8_10.1.i686 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • apr-util-devel-0:1.6.1-9.el8_10.1.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +57 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Ensure that the Redis server used by the application is deployed in a trusted, network-segregated environment and is not accessible to untrusted parties. Where possible, configure authentication and TLS on the Redis connection to reduce the risk of a compromised or spoofed Redis server. Workaround: Restrict network access for applications that use the `apr-util` memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect.

🔗 References (7)