CVE-2026-34191
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.
Risk Assessment
An attacker could inject malicious SQL queries, potentially leading to unauthorized data access, modification, or deletion.
Recommendation
It is recommended to upgrade Apache Portable Runtime Utility to version 1.6.4 or later, which includes the fix.
Other vulnerabilities in Apache Portable Runtime Utility
See all- CVE-2026-34502High
A heap-based buffer overflow vulnerability exists in the memcached client of Apache Portable Runtime Utility. This issue affects versions from 1.3.0 through 1.6.3.
- CVE-2026-34501High
A heap-based buffer overflow vulnerability exists in the redis client of Apache Portable Runtime Utility. This issue affects versions from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3