ELSA-2026-69113

ELSA-2026-69113 - apr-util security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-09-23

Description

[1.6.1-9.1]
- Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information
disclosure via timing attack in password validation (CVE-2025-49506)
- Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in APR memcached client (CVE-2026-34502)
- Resolves: RHEL-236475 - apr-util: Apache Portable Runtime Utility: Heap buffer
overflow in redis client (CVE-2026-34501)
- Resolves: RHEL-235668 - apr-util: APR-util: Denial of Service via XML stack
recursion attack (CVE-2026-32327)

Related CVEs

CVE-2025-49506

CVE-2026-32327

CVE-2026-34501

CVE-2026-34502

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	apr-util-1.6.1-9.el8_10.1.src.rpm	b6acf26de4566da9852e7ad0e8a331ddc7ea8c69d510027e064ba09ebcae5916	-	ol8_aarch64_appstream
	apr-util-1.6.1-9.el8_10.1.aarch64.rpm	28d842180cf69ee10d9a925cbbe8f5492973b8ba1a933b2192ae05806e3ea4da	-	ol8_aarch64_appstream
	apr-util-bdb-1.6.1-9.el8_10.1.aarch64.rpm	6d8df145df4a712b53a83b45f038bd403f9c0d0dec15a9264aef435789f61a5d	-	ol8_aarch64_appstream
	apr-util-devel-1.6.1-9.el8_10.1.aarch64.rpm	baa73cf93ed13e04f109f191c3423b547798ca22f1ea89b6bcc517bac1dc681a	-	ol8_aarch64_appstream
	apr-util-ldap-1.6.1-9.el8_10.1.aarch64.rpm	76b87a68db8e12662344c6421dea1963245bd79091cf7b38751587cc55b1bd61	-	ol8_aarch64_appstream
	apr-util-mysql-1.6.1-9.el8_10.1.aarch64.rpm	542d4e833e7527489f2c51451b5f9ba537104c096a8d5e4e285e1adcecc64aa0	-	ol8_aarch64_appstream
	apr-util-odbc-1.6.1-9.el8_10.1.aarch64.rpm	04cad3856274be7601a66734267f88bb5cb780e4a72df68612e1a9164f33a0b8	-	ol8_aarch64_appstream
	apr-util-openssl-1.6.1-9.el8_10.1.aarch64.rpm	031d2c5810bc9a8e420675bffae1357996e5515c8d7f0266c0b2f148e57f0eee	-	ol8_aarch64_appstream
	apr-util-pgsql-1.6.1-9.el8_10.1.aarch64.rpm	e997f7564075738451264737bf2df4dd7e2b609a53da1fffc9ad99c5b2e101b8	-	ol8_aarch64_appstream
	apr-util-sqlite-1.6.1-9.el8_10.1.aarch64.rpm	2bf3d98730551ea1ac5dbc6ee72c5f0f7cadba6541fa249ade0d3f7e4e29d7c2	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	apr-util-1.6.1-9.el8_10.1.src.rpm	b6acf26de4566da9852e7ad0e8a331ddc7ea8c69d510027e064ba09ebcae5916	-	ol8_x86_64_appstream
	apr-util-1.6.1-9.el8_10.1.i686.rpm	8fc17caa6c81847a928522644dd77c55a331fc0219f2564f434863de33eb01c0	-	ol8_x86_64_appstream
	apr-util-1.6.1-9.el8_10.1.x86_64.rpm	cedb884aac9169722c1fd4caf3e791338b236b06b2d639a8ee123b4e6d679f8a	-	ol8_x86_64_appstream
	apr-util-bdb-1.6.1-9.el8_10.1.i686.rpm	f03042923219d6d461aecf3528dae0490ea0dc47898461410cded66fb7be590d	-	ol8_x86_64_appstream
	apr-util-bdb-1.6.1-9.el8_10.1.x86_64.rpm	a3ed350b2ab3337c9d4db8429850dac2d48a7b2bd5e3dbd9df146a5f37ab95ff	-	ol8_x86_64_appstream
	apr-util-devel-1.6.1-9.el8_10.1.i686.rpm	fe72e9fa41d0f800f9a2a0ca31d2187ffb094434d2ea1cfdf4fced10a1e20e88	-	ol8_x86_64_appstream
	apr-util-devel-1.6.1-9.el8_10.1.x86_64.rpm	ae3cc0b88b270877494ec8fd45349acb971c1766120ee97e20dbfaf0f926aed3	-	ol8_x86_64_appstream
	apr-util-ldap-1.6.1-9.el8_10.1.x86_64.rpm	d8155f33a537f4f545546ca7b208171a5526f546958cf134ecc482dac31397e9	-	ol8_x86_64_appstream
	apr-util-mysql-1.6.1-9.el8_10.1.x86_64.rpm	7bdd9b26b71b92a683e34f314e3fafaa1982d9380828672b8313a426d7cc684c	-	ol8_x86_64_appstream
	apr-util-odbc-1.6.1-9.el8_10.1.x86_64.rpm	464fe4de6a550c0b1c7c2d4e7f60440d123139378a6470f30cd6ee3c59f17245	-	ol8_x86_64_appstream
	apr-util-openssl-1.6.1-9.el8_10.1.i686.rpm	17459bec2a5fd801cbb560369806d4d6e4ff62db91c2d2a34eea42c26e4864ce	-	ol8_x86_64_appstream
	apr-util-openssl-1.6.1-9.el8_10.1.x86_64.rpm	2c255ddfac2c30bbb3c3d5c1cefef064f6c0f2c88aad851c88ad34ac863880ac	-	ol8_x86_64_appstream
	apr-util-pgsql-1.6.1-9.el8_10.1.x86_64.rpm	b9d594e0d1da0df670ee8af62fdcda3bb7ecf927ab5d7e4f82b44dc0263da441	-	ol8_x86_64_appstream
	apr-util-sqlite-1.6.1-9.el8_10.1.x86_64.rpm	c0909d527ad8c87f2b939e495f9dbd141e24eff81f0716e96483215be0da6ed8	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team