The Apache Software Foundation takes a very active stance in eliminating security problems and denial of service attacks against the Apache Portable Runtime.
We strongly encourage folks to report such problems to our private security mailing list first, before disclosing them in a public forum.
We cannot accept regular bug reports or other queries at this address, we ask that you use our bugzilla page for those. All mail sent to this address that does not relate to security problems in the APR source code will be ignored.
The mailing address is:
security@apache.orgNote that all networked servers are subject to denial of service attacks, and we cannot promise magic workarounds to generic problems (such as a client streaming lots of data to your server, or re-requesting the same URL repeatedly). In general our philosophy is to avoid any attacks which can cause the server to consume resources in a non-linear relationship to the size of inputs.
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Acknowledgements: finder: Michael Rowley <michael csirt.global>
| Reported to security team | 2024-06-03 |
| fixed in 1.6.x by r1936805 | 2026-08-06 |
| Update 1.6.4 released | 2026-08-06 |
| Affects | 1.2.0 through 1.6.3 |
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Acknowledgements:
| Report received | 2026-03-07 |
| fixed in 1.6.x by r1936815 | 2026-08-06 |
| Update 1.6.4 released | 2026-08-06 |
| Affects | through 1.6.3 |
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Acknowledgements: finder: Elhanan Haenel
| Reported to security team | 2026-03-24 |
| fixed in 1.6.x by r1936817 | 2026-08-06 |
| Update 1.6.4 released | 2026-08-06 |
| Affects | 1.6.0 through 1.6.3 |
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.
Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Acknowledgements: finder: Elhanan Haenel
| Reported to security team | 2026-03-27 |
| fixed in 1.6.x by r1936810 | 2026-08-06 |
| Update 1.6.4 released | 2026-08-06 |
| Affects | 1.6.0 through 1.6.3 |
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client
This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
Acknowledgements: finder: Elhanan Haenel
| Reported to security team | 2026-03-27 |
| fixed in 1.6.x by r1936813 | 2026-08-06 |
| Update 1.6.4 released | 2026-08-06 |
| Affects | 1.3.0 through 1.6.3 |
