{"cves":["CVE-2025-49506","CVE-2026-32327","CVE-2026-34501","CVE-2026-34502"],"cvss":0.0,"database_specific":{"severity":"MODERATE"},"description":"[1.6.1-9.1]\n- Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information\n  disclosure via timing attack in password validation (CVE-2025-49506)\n- Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer\n  overflow in APR memcached client (CVE-2026-34502)\n- Resolves: RHEL-236475 - apr-util: Apache Portable Runtime Utility: Heap buffer\n  overflow in redis client (CVE-2026-34501)\n- Resolves: RHEL-235668 - apr-util: APR-util: Denial of Service via XML stack\n  recursion attack (CVE-2026-32327)","id":"ELSA-2026-69113","ovalId":"oval:com.oracle.elsa:def:202669113","source":"oracle_linux","title":"ELSA-2026-69113:  apr-util security update (MODERATE)","url":"https://linux.oracle.com/errata/ELSA-2026-69113.html"}