Description

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-06T15:16:54.190Z",
  "pubdate": "2026-08-06T15:16:54.190Z",
  "executiveSummary": "A stack recursion vulnerability exists in APR-util version 1.6.3 and earlier, specifically within the XML parsing functionality. This flaw exposes any library consumer that parses XML documents from untrusted sources and utilizes the affected function to potential security risks. The primary vulnerability type is stack recursion leading to denial of service, where improper handling of nested XML elements causes excessive stack consumption. The impact of successful exploitation includes application crashes, potential denial of service (DoS) for dependent services, and disruption of normal operations. Affected systems include applications leveraging APR-util version 1.6.3 or prior. Risk implications are moderate to high depending on the exposure of the XML parsing interface to untrusted inputs. Attacker capabilities require the ability to supply malicious or deeply nested XML payloads to the vulnerable application. Exploitation requirements mandate that the target application processes untrusted XML input using the flawed quoting mechanism without adequate depth validation or recursion limits.",
  "technicalDetails": "The vulnerability resides in the apr_xml_quote_elem() function of the Apache Portable Runtime Utility (APR-util) library, specifically affecting version 1.6.3 and earlier. The root cause of the issue stems from an absence of proper depth checks or iterative handling when processing recursive structures within XML elements. During the execution of apr_xml_quote_elem(), the component recursively processes nested XML elements or entity structures without restricting the recursion depth. When an untrusted source provides a specially crafted XML document containing an excessively deep hierarchy of nested elements, each recursive function call consumes stack frame memory. The exploitation method relies on supplying a malicious XML payload engineered to maximize stack frame allocation during the parsing and quoting phase. The attack flow begins when a library consumer ingests the malicious XML from an untrusted network or local source. The application passes the XML structure to the vulnerable apr_xml_quote_elem() function. As the function traverses the deeply nested XML elements, uncontrolled recursive function calls are executed, rapidly exhausting the allocated thread stack space. This stack exhaustion invariably triggers a segmentation fault or stack overflow exception, causing the host process to abruptly terminate. No authentication or elevated privilege requirements are necessary if the vulnerable XML parsing endpoint is exposed to the network or accessible via unauthenticated input channels. Network exposure depends entirely on how the consumer application exposes its XML parsing capabilities, but remote exploitation is highly feasible if the parser accepts external HTTP requests or untrusted file uploads. The payload behavior is strictly destructive to availability, resulting in application crashes rather than arbitrary code execution, though repeated crashes sustain a permanent denial of service condition."
}