CVE-2026-34501
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A heap-based buffer overflow vulnerability exists in the redis client of Apache Portable Runtime Utility. This issue affects versions from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Risk Assessment
An attacker could exploit the buffer overflow to execute arbitrary code or cause a denial of service, potentially compromising system integrity.
Recommendation
It is recommended to upgrade Apache Portable Runtime Utility to version 1.6.4 or later, which includes the fix.
Other vulnerabilities in Apache Portable Runtime Utility
See all- CVE-2026-34191Critical
An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.
- CVE-2026-34502High
A heap-based buffer overflow vulnerability exists in the memcached client of Apache Portable Runtime Utility. This issue affects versions from 1.3.0 through 1.6.3.
Original NVD description (English source)
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.