{"cves":["CVE-2025-49506","CVE-2026-32327","CVE-2026-34501","CVE-2026-34502"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[1.6.1-23.1]\n- Resolves: RHEL-236631 - apr-util: Apache Portable Runtime Utility: Information\n  disclosure via timing attack in password validation (CVE-2025-49506)\n- Resolves: RHEL-236266 - apr-util: Apache Portable Runtime Utility: Heap buffer\n  overflow in APR memcached client (CVE-2026-34502)\n- Resolves: RHEL-236478 - apr-util: Apache Portable Runtime Utility: Heap buffer\n  overflow in redis client (CVE-2026-34501)\n- Resolves: RHEL-235670 - apr-util: APR-util: Denial of Service via XML stack\n  recursion attack (CVE-2026-32327)","id":"ELSA-2026-66341-0","ovalId":"oval:com.oracle.elsa:def:2026663410","source":"oracle_linux","title":"ELSA-2026-66341-0:  apr-util security update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-66341-0.html"}