CVE-2026-32327
Awaiting Analysis Awaiting Analysis - Queue

Stack Recursion Vulnerability in APR-util XML Parser

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-32327
EUVD
EUVD-2026-53919

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apr-util to 1.6.4 (exc)
apache apr-util 1.6.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack recursion attack in APR-util version 1.6.3 and earlier. It occurs when parsing XML from untrusted sources using the apr_xml_quote_elem() function, potentially causing a crash or denial of service.

Detection Guidance

Check if your system uses APR-util version 1.6.3 or earlier by running: apr-util -v or rpm -qa | grep apr-util. If vulnerable, upgrade to version 1.6.4 or later.

Impact Analysis

If you use APR-util to parse XML from untrusted sources, this bug could allow attackers to trigger excessive recursion, leading to application crashes or system instability. Upgrading to version 1.6.4 fixes the issue.

Mitigation Strategies

Upgrade APR-util to version 1.6.4 or later immediately. If upgrading is not possible, avoid parsing XML from untrusted sources or disable the apr_xml_quote_elem function if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-32327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart