Author: covener
Date: Thu Aug 6 12:43:27 2026
New Revision: 1936914
Log:
publishing release apr-util-1.6.4
Modified:
apr/apr-util/branches/1.6.x/CHANGES
apr/apr-util/branches/1.6.x/NOTICE
apr/apr-util/branches/1.6.x/STATUS
apr/apr-util/branches/1.6.x/include/apu_version.h
Modified: apr/apr-util/branches/1.6.x/CHANGES
==============================================================================
--- apr/apr-util/branches/1.6.x/CHANGES Thu Aug 6 12:40:39 2026 (r1936913)
+++ apr/apr-util/branches/1.6.x/CHANGES Thu Aug 6 12:43:27 2026 (r1936914)
@@ -1,6 +1,59 @@
-*- coding: utf-8 -*-
+Changes with APR-util 1.6.5
+
Changes with APR-util 1.6.4
+ *) SECURITY: CVE-2026-34502: Heap buffer overflow in APR memcached
+ client (cve.mitre.org)
+ Heap-based Buffer Overflow vulnerability in Apache Portable
+ Runtime Utility memcached client
+ This issue affects Apache Portable Runtime Utility: from 1.3.0
+ through 1.6.3.
+ Credits: Elhanan Haenel
+
+ *) SECURITY: CVE-2026-34501: Apache Portable Runtime Utility: Heap
+ buffer overflow in APR redis client (cve.mitre.org)
+ Heap-based Buffer Overflow vulnerability in Apache Portable
+ Runtime Utility redis client.
+ This issue affects Apache Portable Runtime Utility: from 1.6.0
+ through 1.6.3.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ the issue.
+ Credits: Elhanan Haenel
+
+ *) SECURITY: CVE-2026-34191: Apache Portable Runtime Utility: SQL
+ Injection in apr_dbd_oracle (cve.mitre.org)
+ Improper Neutralization of Special Elements used in an SQL
+ Command ('SQL Injection') vulnerability in Apache Portable
+ Runtime Utility via apr_dbd_oracle provider.
+ This issue affects Apache Portable Runtime Utility: from 1.6.0
+ through 1.6.3.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ the issue.
+ Credits: Elhanan Haenel
+
+ *) SECURITY: CVE-2026-32327: Apache Portable Runtime Utility:
+ apr-util XML stack recursion crash (cve.mitre.org)
+ A bug in APR-util version 1.6.3 (and earlier) allows a stack
+ recursion attack against any library consumer which parses XML
+ from untrusted sources and uses the apr_xml_quote_elem()
+ function.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ this issue.
+ Credits: Younghyo Cho @ CISLab, SeoulTech
+
+ *) SECURITY: CVE-2025-49506: apr_password_validate() vulnerable to
+ timing attack (cve.mitre.org)
+ APR-util versions 1.6.3 (and earlier) function
+ apr_password_validate() was not constant-time with regards to
+ hashes or passwords comparisons, potentially leaking their
+ content via a side channel timing attack particularly on
+ platforms without crypt() such as Windows, BeOS, NetWare, or
+ Android.
+ Users are recommended to upgrade to version 1.6.4, which fixes
+ this issue.
+ Credits: Michael Rowley <michael csirt.global>
+
*) apr_brigade: Don't split the final LF in apr_brigade_split_line() to
avoid producing an empty bucket. PR 64273
[Barnim Dzwillo <dzwillo strato.de>, Joe Orton]
Modified: apr/apr-util/branches/1.6.x/NOTICE
==============================================================================
--- apr/apr-util/branches/1.6.x/NOTICE Thu Aug 6 12:40:39 2026 (r1936913)
+++ apr/apr-util/branches/1.6.x/NOTICE Thu Aug 6 12:43:27 2026 (r1936914)
@@ -1,5 +1,5 @@
Apache Portable Runtime Utility Library
-Copyright 2025 The Apache Software Foundation.
+Copyright 2026 The Apache Software Foundation.
This product includes software developed at
The Apache Software Foundation (http://www.apache.org/).
Modified: apr/apr-util/branches/1.6.x/STATUS
==============================================================================
--- apr/apr-util/branches/1.6.x/STATUS Thu Aug 6 12:40:39 2026 (r1936913)
+++ apr/apr-util/branches/1.6.x/STATUS Thu Aug 6 12:43:27 2026 (r1936914)
@@ -4,7 +4,8 @@ Last modified at [$Date$]
Releases:
2.0.0 : None/EOL - merged into ../apr/trunk/
1.7.0 : in development on branches/1.7.x
- 1.6.4 : in maintenance
+ 1.6.5 : in maintenance
+ 1.6.4 : released August 06, 2026
1.6.3 : released February 1, 2023
1.6.2 : released January 31, 2023
1.6.1 : released October 22, 2017
Modified: apr/apr-util/branches/1.6.x/include/apu_version.h
==============================================================================
--- apr/apr-util/branches/1.6.x/include/apu_version.h Thu Aug 6 12:40:39 2026 (r1936913)
+++ apr/apr-util/branches/1.6.x/include/apu_version.h Thu Aug 6 12:43:27 2026 (r1936914)
@@ -61,7 +61,7 @@
* The Patch Level never includes API changes, simply bug fixes.
* Reset to 0 when upgrading APR_MINOR_VERSION
*/
-#define APU_PATCH_VERSION 4
+#define APU_PATCH_VERSION 5
/**
* The symbol APU_IS_DEV_VERSION is only defined for internal,
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.