CVE-2026-32327: 
NixOS vulnerability analysis and mitigation

CVE-2026-32327 is a stack recursion (uncontrolled recursion) vulnerability in Apache Portable Runtime Utility (APR-util) versions 1.6.3 and earlier that allows unauthenticated remote attackers to trigger a denial-of-service condition. The flaw resides in the apr_xml_quote_elem() function, which is susceptible to a stack recursion attack when parsing XML from untrusted sources. It was disclosed on August 6, 2026, with a patch released in APR-util version 1.6.4. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-674 (Uncontrolled Recursion): the apr_xml_quote_elem() function in APR-util does not properly limit the depth of recursion when processing XML elements, allowing a specially crafted XML document with deeply nested or self-referential structures to exhaust the call stack. The attack vector is network-based, requires no authentication or user interaction, and targets any application that uses APR-util to parse XML from untrusted input. This makes the vulnerability broadly exploitable across any software stack that depends on APR-util for XML processing, including Apache HTTP Server and other Apache ecosystem components (Apache Advisory, GitHub Advisory).

Successful exploitation causes a stack exhaustion crash in any application consuming APR-util's XML parsing functionality, resulting in a denial-of-service condition. The CVSS scoring reflects high impacts on both confidentiality and availability, with no integrity impact — the confidentiality impact may arise from application crash states exposing sensitive data in memory or logs. Any service relying on APR-util for XML parsing (e.g., Apache HTTP Server with mod_dav or similar modules) is at risk of being rendered unavailable by a single malicious XML request (Apache Advisory, GitHub Advisory).

As of the disclosure date (August 6, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability is rated as automatable (no user interaction required), making it straightforward to exploit at scale once a PoC becomes available. The EPSS score is 0.0 and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Apache Advisory, GitHub Advisory).

The primary remediation is to upgrade APR-util to version 1.6.4 or later, which resolves the uncontrolled recursion in apr_xml_quote_elem(). As an interim workaround, organizations should restrict XML parsing to trusted sources only and, where possible, implement recursion depth limits at the application framework level. Downstream software that bundles APR-util (e.g., Apache HTTP Server distributions) should also be updated as vendors release patched packages (Apache Advisory, GitHub Advisory).

The vulnerability was announced via the Apache mailing list on August 6, 2026, and was picked up by security aggregators including OSS-Security and CVE feed services shortly after. A post on Bluesky (infosec.skyfleet.blue) noted the disclosure, indicating early community awareness. No major vendor statements or notable researcher deep-dives have been published beyond the initial Apache advisory as of the disclosure date (OSS-Sec List, Apache Advisory).