According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

    This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

    APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards     to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack     particularly on platforms without crypt() such as    Windows, BeOS, NetWare, or Android.

    Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

    This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

    Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

    A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer     which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.(CVE-2026-32327)

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in     Apache Portable Runtime Utility via apr_dbd_oracle provider.

    This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Tenable has extracted the preceding description block directly from the EulerOS apr-util security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards     to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack     particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

    Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

    This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

    Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

    A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer     which parses XML from untrusted sources and uses the  apr_xml_quote_elem() function.

    Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

    This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in     Apache Portable Runtime Utility via apr_dbd_oracle provider.

    This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Tenable has extracted the preceding description block directly from the EulerOS apr-util security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4742 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4742-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     August 16, 2026                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : apr-util     Version        : 1.6.1-5+deb11u2 1.6.3-1+deb12u1     CVE ID         : CVE-2025-49506 CVE-2026-32327 CVE-2026-34191 CVE-2026-34501                      CVE-2026-34502     Debian Bug     : 1143837


    Several vulnerabilities were discovered in apr-util, the Apache Portable     Runtime Utility library, which could result in denial of service or     potentially the execution of arbitrary code.

    For Debian 11 bullseye, these problems have been fixed in version     1.6.1-5+deb11u2.

    For Debian 12 bookworm, these problems have been fixed in version     1.6.3-1+deb12u1.

    We recommend that you upgrade your apr-util packages.

    For the detailed security status of apr-util please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/apr-util

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786553851 advisory.

  - APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards     to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack     particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are     recommended to upgrade to version 1.6.4, which fixes this issue. (CVE-2025-49506)

  - A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer     which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended     to upgrade to version 1.6.4, which fixes this issue. (CVE-2026-32327)

  - Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue     affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to     version 1.6.4, which fixes the issue. (CVE-2026-34501)

  - Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue     affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3. (CVE-2026-34502)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1836:01 advisory.

    * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
      * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password     validation (CVE-2025-49506)
      * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack     (CVE-2026-32327)
      * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client     (CVE-2026-34502)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69113 advisory.

    - Resolves: RHEL-236630 - apr-util: Apache Portable Runtime Utility: Information       disclosure via timing attack in password validation (CVE-2025-49506)
    - Resolves: RHEL-236267 - apr-util: Apache Portable Runtime Utility: Heap buffer       overflow in APR memcached client (CVE-2026-34502)
    - Resolves: RHEL-236475 - apr-util: Apache Portable Runtime Utility: Heap buffer       overflow in redis client (CVE-2026-34501)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-663410 advisory.

    - Resolves: RHEL-236631 - apr-util: Apache Portable Runtime Utility: Information       disclosure via timing attack in password validation (CVE-2025-49506)
    - Resolves: RHEL-236266 - apr-util: Apache Portable Runtime Utility: Heap buffer       overflow in APR memcached client (CVE-2026-34502)
    - Resolves: RHEL-236478 - apr-util: Apache Portable Runtime Utility: Heap buffer       overflow in redis client (CVE-2026-34501)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:66341 advisory.

    * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

    * apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password     validation (CVE-2025-49506)

    * apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack     (CVE-2026-32327)

    * apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the apr-util packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards     to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack     particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are     recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

    This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

    Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in     Apache Portable Runtime Utility via apr_dbd_oracle provider.

    This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

    This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

    A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer     which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.(CVE-2026-32327)

Tenable has extracted the preceding description block directly from the EulerOS apr-util security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
364997	EulerOS 2.0 SP11 : apr-util (EulerOS-SA-2026-4211)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical
376677	EulerOS 2.0 SP12 : apr-util (EulerOS-SA-2026-4467)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical
335907	Debian dla-4742 : libaprutil1 - security update	Nessus	Debian Local Security Checks	2026/8/16	2026/8/16	critical
360536	AlmaLinux 9.2 [TuxCare] Security Update: apr-util / apr-util-bdb / apr-util-devel / apr-util-ldap / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786553851)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	critical
345890	MiracleLinux 9 : apr-util-1.6.1-23.el9_8.1 (AXSA:2026-1836:01)	Nessus	Miracle Linux Local Security Checks	2026/9/15	2026/9/15	critical
349492	Oracle Linux 8 : apr-util (ELSA-2026-69113)	Nessus	Oracle Linux Local Security Checks	2026/9/23	2026/9/23	critical
344604	Oracle Linux 9 : ELSA-2026-66341-0: / apr-util (ELSA-2026-663410)	Nessus	Oracle Linux Local Security Checks	2026/9/10	2026/9/10	critical
344824	RockyLinux 9 : apr-util (RLSA-2026:66341)	Nessus	Rocky Linux Local Security Checks	2026/9/11	2026/9/11	critical
364934	EulerOS 2.0 SP13 : apr-util (EulerOS-SA-2026-4120)	Nessus	Huawei Local Security Checks	2026/10/12	2026/10/12	critical
376762	EulerOS 2.0 SP12 : apr-util (EulerOS-SA-2026-4390)	Nessus	Huawei Local Security Checks	2026/11/6	2026/11/6	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical