Red Hat Updates APR-util on RHEL 8 for Four Vulnerabilities
Tech GuruQuick Answer
Red Hat's RHSA-2026:69113 updates APR-util in RHEL 8 AppStream to 1.6.1-9.el8_10.1. It covers password-validation timing, XML recursion, and malformed Redis or memcached responses. Red Hat rates the update Moderate; the individual CVSS scores span Medium to High.
Confirm Scope And Apply The Supported Fix
What to do now: Identify RHEL 8 applications using APR-util, check which XML, password-validation, Redis-client, or memcached-client functions they use, install the supported package, and validate those dependent workflows.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | RHEL 8 AppStream apr-util packages, build family el8_10 |
|---|---|
| Advisory | RHSA-2026:69113 |
| CVEs | CVE-2025-49506, CVE-2026-32327, CVE-2026-34501, CVE-2026-34502 |
| Authoritative release date | 2026-09-21 06:13:42 UTC |
| Authority revision date | 2026-09-21 06:14:22 UTC |
| Affected versions | APR-util packages in the advisory's RHEL 8 AppStream product scope before the listed fixed build. |
| Fixed version | apr-util 1.6.1-9.el8_10.1 |
| CVSS base score | 5.9 / 6.2 / 7.5 (CVSS v3.1) |
| CVSS severity | Medium to High |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
CVE-2025-49506 concerns non-constant-time password comparisons, with platform-dependent exposure. CVE-2026-32327 can crash a consumer that passes crafted XML to apr_xml_quote_elem(). CVE-2026-34501 and CVE-2026-34502 concern malformed responses handled by APR-util's Redis and memcached clients, respectively, and can cause denial of service. Updating these clients is not the same as patching a Redis or memcached server.
What To Validate Now
- Inventory. Record the RHEL 8 APR-util package, dependent applications, and which of the four affected library functions are used.
- Establish applicability. Match the installed package and repository to RHSA-2026:69113. Assess untrusted XML, password-comparison calls, and responses from cache servers separately; the four CVEs do not share one input path.
- Remediate. Apply apr-util 1.6.1-9.el8_10.1 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the updated library and supported activation steps, then exercise approved XML processing, authentication, and cache-client operations used by the application.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
