Linuxsecurity Critical Vulnerabilities Found in APR-util Affecting Multiple Ubuntu Versions
Article Content
- •Multiple critical vulnerabilities found in APR-util affecting several Ubuntu LTS versions.
- •CVE-2025-49506 allows potential sensitive information disclosure due to improper hash comparisons.
- •Heap-based buffer overflows could lead to application crashes or arbitrary code execution.
On September 3, 2026, Ubuntu released USN-8719-1, detailing several security vulnerabilities in APR-util. The vulnerabilities include improper password hash comparisons (CVE-2025-49506), recursive XML element quoting issues (CVE-2026-32327), and heap-based buffer overflows in the Redis (CVE-2026-34501) and memcached clients (CVE-2026-34502). These flaws could lead to sensitive information disclosure, application crashes, or arbitrary code execution. Affected systems include Ubuntu 18.04, 20.04, 22.04, 24.04, and 26.04 LTS. The vulnerabilities were published on August 6, 2026, and require immediate patching to mitigate risks. Administrators are advised to update their systems to the latest package versions to address these issues.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Ubuntu and CVE-2025-49506 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…