CVE-2026-34502

HighCVSS 7.5

Published: 06/08/2026(UTC)Updated: 07/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

42th percentile - higher than 42% of all known CVEs

Summary

A heap-based buffer overflow vulnerability exists in the memcached client of Apache Portable Runtime Utility. This issue affects versions from 1.3.0 through 1.6.3.

Risk Assessment

An attacker could exploit the buffer overflow to execute arbitrary code or cause a denial of service, potentially compromising system integrity.

Recommendation

It is recommended to upgrade Apache Portable Runtime Utility to version 1.6.4 or later, which includes the fix.

Other vulnerabilities in Apache Portable Runtime Utility

See all

CVE-2026-34191Critical
An SQL Injection vulnerability exists in Apache Portable Runtime Utility via the apr_dbd_oracle provider. This issue affects versions from 1.6.0 through 1.6.3.
CVE-2026-34501High
A heap-based buffer overflow vulnerability exists in the redis client of Apache Portable Runtime Utility. This issue affects versions from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

Original NVD description (English source)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.