StackRadar

CVE-2026-32327

Critical

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.1
base score, highest
EPSS
0.005
39th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
155
of 17,781 indexed, latest versions
Container images
159
deployed by those charts
Fix available
3 of 3
affected packages

Apache Portable Runtime Utility: apr-util XML stack recursion crash

Carried by container images the latest versions of 155 of 17,781 indexed charts deploy, on 159 images.

Affected packageAffected versionsFixed inImages
apr-utildeb1.6.1-4ubuntu2, 1.6.1-4ubuntu2.2, 1.6.1-5ubuntu4.22.04.2, 1.6.3-1+2 more1.6.1-4ubuntu2.2+esm1, 1.6.1-5ubuntu4.22.04.3, 1.6.3-1.1ubuntu7.1, 1.6.3-1+deb12u1+1 more149
apr-utilapk1.6.3-r1, 1.6.3-r21.6.4-r08
apr-utilbitnami1.6.31.6.42
OSV records
ALPINE-CVE-2026-32327BIT-apr-util-2026-32327DEBIAN-CVE-2026-32327UBUNTU-CVE-2026-32327
Also known as
USN-8719-1

Charts affected

155 by stars
ChartLatestAffected imagesRadar Score
owncloudth-chartsVerified publisher0.2.11 of 1See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-32327.

Container imageDigestPackageFixed in
owncloud/server:10.15.051d9b74fc2a8
apr-util@1.6.1-4ubuntu2.2
1.6.1-4ubuntu2.2+esm1

Open the chart page →

10,006
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-32327.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
apr-util@1.6.3-1
1.6.3-1+deb12u1

Open the chart page →

17,323
demo-backendv2flyVerified publisher0.0.31 of 1See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-32327.

Container imageDigestPackageFixed in
quay.io/yushiwho/api:e1f9d77e0d9b93dbf2b
apr-util@1.6.3-1
1.6.3-1+deb12u1

Open the chart page →

14,358
web-dvwaweb-dvwa1.16.01 of 2See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-32327.

Container imageDigestPackageFixed in
gulacedia/web-dvwa-new:v367b467d961ca
apr-util@1.6.3-1
1.6.3-1+deb12u1

Open the chart page →

10,001
zoo-project-druzoo-projectOfficialVerified publisher0.10.41 of 6See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-32327.

Container imageDigestPackageFixed in
zooproject/zoo-project:dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a9a507cb7e2dd
apr-util@1.6.1-5ubuntu4.22.04.2
1.6.1-5ubuntu4.22.04.3

Open the chart page →

7,849

Container images carrying it

159 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/devtron/devtron-utils:dup-chart-repo-v1.1.095d6f0e05636
apr-util@1.6.3-1
1.6.3-1+deb12u1
6
library/httpd:2.4-alpine:alpine1b766f17b840
apr-util@1.6.3-r2
1.6.4-r0
4
quay.io/devtron/notifier:9804331c-372-39294709c7da19c5a
apr-util@1.6.3-1
1.6.3-1+deb12u1
3
cfssl/cfssl:latest:v1.6.5c9018c2ddf0b
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
gjeanmart/safe-ganache-node:latest926264c8f2d1
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
library/phpmyadmin:5.2.16e75aa8f767c
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
library/python:3.7eedf63967cdb
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
library/wordpress:6.8.3-apache:6.8-apache30bff39330d1
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
2
moreillon/user-manager:v5.0.2e1c9bfab5c16
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
qichenxu4pd/pythonexample:1.0f3a8502bc21b
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
uffizzi/controller:latest0344805f267b
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
vdiogov/glpi-conteiner:latest6945f84f0058
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
ghcr.io/google/fleetspeak:v0.1.17cd264d33efd4
apr-util@1.6.3-1
1.6.3-1+deb12u1
2
aboogie/login_test_backend:new9c41a4483ac8
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
akaunting/akaunting:3.0.1552811b36ec3a
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
artur9010/wait-for:v1.0.06b4de3ce8b0e
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
assistiot/smart-orchestrator_scheduler_mc:latestb1dbe4d62a03
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
avinash263/pyredis263:latestaa2b8727f1a6
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
beanbag/reviewboard:latest6b840f546e1c
apr-util@1.6.1-5ubuntu4.22.04.2
1.6.1-5ubuntu4.22.04.3
1
beyzkaya/blog-backend:v1.0.112a6a3d1c5f9
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
bitnamilegacy/matomo:5.3.2-debian-12-r13f02c000c54b1
apr-util@1.6.3
1.6.4
1
bloxstaking/ssv-node:v2.2.0bf6d7d2fdc93
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
bnjbvr/kresus:0.22.137e216b182c8
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
carlosmz87/test_helm_backend:latest8ffa63aa995d
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
checkmk/check-mk-community:2.5.0p6c11b422210c4
apr-util@1.6.1-5ubuntu4.22.04.2
1.6.1-5ubuntu4.22.04.3
1
chiefonboarding/chiefonboarding:v2.4.159bc7aa60fe7
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
cloudtooling/moodle:5.2.3f4f04e0fc401
apr-util@1.6.3
1.6.4
1
dgraziotin/nginx-webdav-nononsense:1.23.138f2de42bed0
apr-util@1.6.1-4ubuntu2
1.6.1-4ubuntu2.2+esm1
1
dokuwiki/dokuwiki:2025-05-14af08ecfdda239
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
dolibarr/dolibarr:22.0.47ad88fc9b13c
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
domainmod/domainmod:4.23.04017bfe4c597
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
dragonflyoss/client:v0.1.82edf3e921f4e0
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
eclipseaerios/iota-messages-api:lateste7f5ba0bc64d
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
electriccoinco/lightwalletd:v0.5.42ae3a551e111
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
espocrm/espocrm:9.3.101b5a24504ed9
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
gomods/athens:v0.17.10f61d1e62359
apr-util@1.6.3-r2
1.6.4-r0
1
gomods/athens:v0.18.197cc113b34b0
apr-util@1.6.3-r2
1.6.4-r0
1
gulacedia/web-dvwa-new:v367b467d961ca
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
haveagitgat/tdarr_node:2.00.101e3f9328327d
apr-util@1.6.1-4ubuntu2
1.6.1-4ubuntu2.2+esm1
1
helicone/supabase-migration-runner:v2025.03.05-14a913936c97b
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
ildarmukhametzyanov/priceapp:0.115d23720a3ee
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
instill/artifact-backend:b28766ac4a393e601ed
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
instill/mgmt-backend:d0933d4ebe12f77a3f9
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
instill/model-backend:611f0f2e980125e5ba5
apr-util@1.6.3-3+b1
1.6.3-3+deb13u1
1
intelowlproject/intelowl:v6.6.10b22e547ea6b
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
jhoncytech/bookworm-apache-wordpress:latest18c3ca1f411e
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
jordan/icinga2:latestf75025fe8ea8
apr-util@1.6.3-1
1.6.3-1+deb12u1
1
kfirfer/phppgadmin:7.13.0-22efb4a5d74a3
apr-util@1.6.1-4ubuntu2
1.6.1-4ubuntu2.2+esm1
1
kimai/kimai2:2.65.06dfc63199654
apr-util@1.6.3-1
1.6.3-1+deb12u1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.