ELSA-2026-66392-0

ELSA-2026-66392-0 - apr-util security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-10

Description

[1.6.3-23.1]
- Resolves: RHEL-236629 - apr-util: Apache Portable Runtime Utility: Information
disclosure via timing attack in password validation (CVE-2025-49506)
- Resolves: RHEL-236264 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in APR memcached client (CVE-2026-34502)
- Resolves: RHEL-236469 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in redis client (CVE-2026-34501)
- Resolves: RHEL-235667 - apr-util: APR-util: Denial of Service via XML stack
recursion attack (CVE-2026-32327)

Related CVEs

CVE-2025-49506

CVE-2026-32327

CVE-2026-34501

CVE-2026-34502

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	apr-util-1.6.3-23.el10_2.1.src.rpm	d892217d8a3d56b7636e5a00c88579b3384dc6e93aed5b89532f495c74aad495	-	ol10_aarch64_appstream
	apr-util-1.6.3-23.el10_2.1.aarch64.rpm	b450988e00d581634f21f03940b299c4b43847444526f7b3a2aba0b1e8a21b2a	-	ol10_aarch64_appstream
	apr-util-devel-1.6.3-23.el10_2.1.aarch64.rpm	61c0f18b0e986ebe8edc60a6e0a7184d14ba2b871facfe80bbc90181c8d5742f	-	ol10_aarch64_appstream
	apr-util-ldap-1.6.3-23.el10_2.1.aarch64.rpm	62ea5db5825b3156f76ff3bc821aa14c855925bb3c9c730c77bbe81cae52d2f1	-	ol10_aarch64_appstream
	apr-util-lmdb-1.6.3-23.el10_2.1.aarch64.rpm	35f84ec6943b40d72d96bd8e01f78e2337f81326f25d5403dc53bffe7cc02bf0	-	ol10_aarch64_appstream
	apr-util-mysql-1.6.3-23.el10_2.1.aarch64.rpm	8c1b556434f31b0cc2ce14b91b04234d3708b0ece70c24f56278e47bc4b14a80	-	ol10_aarch64_appstream
	apr-util-odbc-1.6.3-23.el10_2.1.aarch64.rpm	9b43c32c408b5236781c0ef0e99243981a29ad48f0c1b924282df9cd7101f9df	-	ol10_aarch64_appstream
	apr-util-openssl-1.6.3-23.el10_2.1.aarch64.rpm	9880fe51b3b567cececbe90d2beff08c733b6b5471a5466374f0962bade17628	-	ol10_aarch64_appstream
	apr-util-pgsql-1.6.3-23.el10_2.1.aarch64.rpm	7c3513dde0254b8d2bb347d2ad47dd89234a7d5283d083c16305c050ae622715	-	ol10_aarch64_appstream
	apr-util-sqlite-1.6.3-23.el10_2.1.aarch64.rpm	99d639cb18696ee4a9be1828108edae8fc38ca0a02735a2cadbec216e56ee201	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	apr-util-1.6.3-23.el10_2.1.src.rpm	d892217d8a3d56b7636e5a00c88579b3384dc6e93aed5b89532f495c74aad495	-	ol10_x86_64_appstream
	apr-util-1.6.3-23.el10_2.1.x86_64.rpm	24a897d00c9279d5edf242e90973e8a22b8c606b2d68793cb48310c41307d994	-	ol10_x86_64_appstream
	apr-util-devel-1.6.3-23.el10_2.1.x86_64.rpm	6ac63f7d932cef3bbcf87221f09490b339d9c81b6c6e5a100c33143d581f64b7	-	ol10_x86_64_appstream
	apr-util-ldap-1.6.3-23.el10_2.1.x86_64.rpm	d0201adc79f75d37fda385d304c0ed9831da703377cd1822db8a0d748494626a	-	ol10_x86_64_appstream
	apr-util-lmdb-1.6.3-23.el10_2.1.x86_64.rpm	419e098b99e6d9c0790600529589a5ccde05e6a8d33d0cdfa86847f58cecdfda	-	ol10_x86_64_appstream
	apr-util-mysql-1.6.3-23.el10_2.1.x86_64.rpm	a1f5c3e1fd007dce4135cae59013b0b95e6aae51ab9cdaaca4117bc1066a68fe	-	ol10_x86_64_appstream
	apr-util-odbc-1.6.3-23.el10_2.1.x86_64.rpm	072c78bc910fb0a25dbc88feb5dc7917130bcc2cf7a34715c5f5858191e6436c	-	ol10_x86_64_appstream
	apr-util-openssl-1.6.3-23.el10_2.1.x86_64.rpm	273ba421f01d8e17bd6adce20759fa3d2d67f8b9f8c67a9352e02e8ed7c7e79e	-	ol10_x86_64_appstream
	apr-util-pgsql-1.6.3-23.el10_2.1.x86_64.rpm	713e5b402368ab7d6ab96ab61a8108406cde3c7431b5f9361e1f3c89b1e2db34	-	ol10_x86_64_appstream
	apr-util-sqlite-1.6.3-23.el10_2.1.x86_64.rpm	74b758fcaefb57a40f0a06e63c92b38fe41c106b8c89e32e9f99b9659e8e97c4	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team