CVE-2026-34191

CriticalCVSS 9.1

Published: 06/08/2026(UTC)Updated: 06/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Summary

An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.

Risk Assessment

An attacker could inject malicious SQL queries, potentially leading to unauthorized data access, modification, or deletion.

Recommendation

It is recommended to upgrade Apache Portable Runtime Utility to version 1.6.4 or later, which includes the fix.

Original NVD description (English source)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3