ELSA-2026-66341-0

ELSA-2026-66341-0 - apr-util security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-10

Description

[1.6.1-23.1]
- Resolves: RHEL-236631 - apr-util: Apache Portable Runtime Utility: Information
disclosure via timing attack in password validation (CVE-2025-49506)
- Resolves: RHEL-236266 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in APR memcached client (CVE-2026-34502)
- Resolves: RHEL-236478 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in redis client (CVE-2026-34501)
- Resolves: RHEL-235670 - apr-util: APR-util: Denial of Service via XML stack
recursion attack (CVE-2026-32327)

Related CVEs

CVE-2025-49506

CVE-2026-32327

CVE-2026-34501

CVE-2026-34502

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	apr-util-1.6.1-23.el9_8.1.src.rpm	1ad114f07bc1a4384876fd86bf881179ac1b1e114e8c4868ae5d5c79607af316	-	ol9_aarch64_appstream
	apr-util-1.6.1-23.el9_8.1.aarch64.rpm	9386ed8a49c88312d846875bbe84f4a166529765e79d44554a64ef3879abc0c6	-	ol9_aarch64_appstream
	apr-util-bdb-1.6.1-23.el9_8.1.aarch64.rpm	dbb43b7ee6b909fe3a9e48a77090276567fe464a7772e89a3cdc397b944c53b2	-	ol9_aarch64_appstream
	apr-util-devel-1.6.1-23.el9_8.1.aarch64.rpm	848dee97b90963dc9db973b34de5d94f3e4ca2e5428365fa162998281177d4f4	-	ol9_aarch64_appstream
	apr-util-ldap-1.6.1-23.el9_8.1.aarch64.rpm	ce7e8140affb9f4b61053b98970c2af1fb63830304064858683f0e3dd1dea66b	-	ol9_aarch64_appstream
	apr-util-mysql-1.6.1-23.el9_8.1.aarch64.rpm	c2721f44633dcc678c7fefe6a8ce016879ed68a691c3df53d3dd801e205d69d7	-	ol9_aarch64_appstream
	apr-util-odbc-1.6.1-23.el9_8.1.aarch64.rpm	6b7b7d5a36f487416c7cacc9a122f098214ae5595ec583e52841cf16e0adaf31	-	ol9_aarch64_appstream
	apr-util-openssl-1.6.1-23.el9_8.1.aarch64.rpm	cd1a16ce175aeccafe9a43aadd8e43e4785cff565d06392f28df50387d45f72b	-	ol9_aarch64_appstream
	apr-util-pgsql-1.6.1-23.el9_8.1.aarch64.rpm	e0116ec848ef5a8a292e277f9af4b18ea4fb42d92a3cef003064a85fad185dc3	-	ol9_aarch64_appstream
	apr-util-sqlite-1.6.1-23.el9_8.1.aarch64.rpm	21ead5e49a6ef3cbce4079780c2344b7b903d9ff2785a19414d6e75925c3da90	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	apr-util-1.6.1-23.el9_8.1.src.rpm	1ad114f07bc1a4384876fd86bf881179ac1b1e114e8c4868ae5d5c79607af316	-	ol9_x86_64_appstream
	apr-util-1.6.1-23.el9_8.1.i686.rpm	1e4f62235be3e4c1b4e80459d11e8e27d805fd959f7f98528fd2eed0dfcf40f4	-	ol9_x86_64_appstream
	apr-util-1.6.1-23.el9_8.1.x86_64.rpm	c7f3779e7a8316b9d4808550f345bbe8d99870a4bffac38b4bee2e8b8c29b8aa	-	ol9_x86_64_appstream
	apr-util-bdb-1.6.1-23.el9_8.1.i686.rpm	cdae5138bf10fc051768dd6079b737540d9585c52a6eab988311122535fa01ad	-	ol9_x86_64_appstream
	apr-util-bdb-1.6.1-23.el9_8.1.x86_64.rpm	d5ca9aac9c9934ccbd21213dd3e10361cd5be472abdf50008c562147b341fcce	-	ol9_x86_64_appstream
	apr-util-devel-1.6.1-23.el9_8.1.i686.rpm	f6722e3a63bb08b9cb2d97c378d4cb8f127947f73c98979e362cf71c70da9cca	-	ol9_x86_64_appstream
	apr-util-devel-1.6.1-23.el9_8.1.x86_64.rpm	760fa61a99edb0e4792eade024b2960a9fda0284826eca748334d46c196f03c8	-	ol9_x86_64_appstream
	apr-util-ldap-1.6.1-23.el9_8.1.x86_64.rpm	727ce25baa7c193ae7ce139a3128f70af6754380e08c402e2a1136d871f2f032	-	ol9_x86_64_appstream
	apr-util-mysql-1.6.1-23.el9_8.1.x86_64.rpm	b0e8d919bc25dd29a904003e4a7f8b201310d2efc00e7c42ff55ce36d9cb91ba	-	ol9_x86_64_appstream
	apr-util-odbc-1.6.1-23.el9_8.1.x86_64.rpm	dba7a0184d164335785cf764902504e527d33aee770addc8611fef37b0ce7be1	-	ol9_x86_64_appstream
	apr-util-openssl-1.6.1-23.el9_8.1.x86_64.rpm	366f4948b0f73b14caade2a1f5b04936801a850c0b2bc864c536b9748909fd3d	-	ol9_x86_64_appstream
	apr-util-pgsql-1.6.1-23.el9_8.1.x86_64.rpm	b6f871fa2f1c85de80cc8ec333d236d1179e9273317f24fdd02cf6064b989ccb	-	ol9_x86_64_appstream
	apr-util-sqlite-1.6.1-23.el9_8.1.x86_64.rpm	caadc5f0af57dcbc24b4bf2cdef8013a7f6f4b7488e77090b2d7bf9800f89305	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team