This vulnerability (CVE-2026-32327) affects Apache Portable Runtime Utility (APR-util) versions up to and including 1.6.3. The flaw is due to uncontrolled recursion in the apr_xml_quote_elem() function when processing XML input from untrusted sources. An attacker can exploit this to cause a stack recursion attack, leading to denial of service. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and availability. The vendor recommends upgrading to version 1.6.4 to remediate the issue.

Successful exploitation of this vulnerability can cause a denial of service condition by triggering uncontrolled recursion in the apr_xml_quote_elem() function. This can crash or destabilize applications using the affected APR-util versions when parsing malicious XML data. There is no indication of integrity or availability impact beyond denial of service, and no known exploits in the wild have been reported.

Users should upgrade Apache Portable Runtime Utility to version 1.6.4 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data. Patch status is confirmed by the vendor's recommendation to upgrade.