This vulnerability is a stack recursion flaw (CWE‑674) that occurs in the apr_xml_quote_elem function of APR‑util when parsing XML from untrusted sources. The recursion can overflow the call stack, causing the consuming application or library to crash, demonstrating a buffer overflow or inappropriate stack usage (CWE‑776). The primary consequence of this behavior is a denial‑of‑service scenario where an attacker can repeatedly send crafted XML to terminate services that depend on APR‑util.

All systems using Apache Portable Runtime Utility version 1.6.3 or earlier are impacted. APR‑util is a core library for many Apache projects, so any application linking against these older versions may be vulnerable if it calls apr_xml_quote_elem on external XML.

The EPSS score is < 1%, implying a low but nonzero probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score is 9.1, indicating high severity. The description shows that the stack recursion flaw can cause the consuming application to crash when parsing malicious XML. Consequently, the potential impact is a denial‑of‑service scenario if an attacker supplies crafted XML that triggers the recursion error.