Every CVE Search/ Get API key

CVE-2026-34191

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

9.1 CriticalFix available

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

0.59%Up 0.3 points since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.1

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2026-53918 9.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
EUVD-2026-53918
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-39fj-527g-2hph 9.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
GHSA-39fj-527g-2hph
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
NVD 9.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVALPINE-CVE-2026-34191 9.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
ALPINE-CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-34191 9.1
Record
BELL-CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 18 moreShow less
OSV 9.1

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-89
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34191 9.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
DEBIAN-CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVOESA-2026-3325 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3325
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3326 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3326
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3327 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3328 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3328
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3409 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3409
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34191 9.1

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
UBUNTU-CVE-2026-34191
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVBIT-apr-util-2026-34191 No score

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Record
BIT-apr-util-2026-34191
Updated
2026-11-02
OSVMGASA-2026-0364 No score

Updated apr-util packages fix security vulnerabilities

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack. (CVE-2025-49506) Apache Portable Runtime Utility: apr-util XML stack recursion crash. (CVE-2026-32327) Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle. (CVE-2026-34191) Apache Portable Runtime Utility: Heap buffer overflow in APR redis client. (CVE-2026-34501) Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client. (CVE-2026-34502)

Record
MGASA-2026-0364
Updated
2026-11-02
OSVopenSUSE-SU-2026:21672-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2025-49506: hash/password content leak via side channel timing attack against apr_password_validate() (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
openSUSE-SU-2026:21672-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-34191 No score

CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-34191
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-34191 No score

CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-34191
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-34191 No score

CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-34191
Updated
2026-11-02
OSVSUSE-SU-2026:23551-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2025-49506: hash/password content leak via side channel timing attack against apr_password_validate() (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:23551-1
Updated
2026-11-02
OSVSUSE-SU-2026:3905-1 No score

Security update for libapr-util1

This update for libapr-util1 fixes the following issues:

  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3905-1
Updated
2026-11-02
OSVSUSE-SU-2026:3937-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3937-1
Updated
2026-11-02
OSVSUSE-SU-2026:3938-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3938-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apr-util
Alpine:v3.21
 1.6.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.22
 1.6.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.23
 1.6.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.24
 1.6.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:23
 1.6.1-r13 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:25
 1.6.3-r2 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:stream
 1.6.1-r13 up to 1.6.4-r0
1.6.4-r0
apr-util
Bitnami
 1.6.0 up to 1.6.5
1.6.5
apr-util
Debian:12
 before 1.6.3-1+deb12u1, plus listed versions
1.6.3-1
1.6.3-1+deb12u1
apr-util
Debian:13
 before 1.6.3-3+deb13u1, plus listed versions
1.6.3-3
1.6.3-3+deb13u1
Show 25 moreShow less
Affected packages
PackageAffectedFixed
apr-util
Debian:14
 before 1.6.4-1, plus listed versions
1.6.3-31.6.3-4
1.6.4-1
apr-util
Mageia:10
From an advisory covering 5 CVEs
 before 1.6.3-3.1.mga10
1.6.3-3.1.mga10
apr-util
Mageia:9
From an advisory covering 5 CVEs
 before 1.6.3-1.1.mga9
1.6.3-1.1.mga9
apr-util
openEuler:20.03-LTS-SP4
From an advisory covering 5 CVEs
 before 1.6.1-16.oe2003sp4
1.6.1-16.oe2003sp4
apr-util
openEuler:22.03-LTS-SP4
From an advisory covering 5 CVEs
 before 1.6.1-16.oe2203sp4
1.6.1-16.oe2203sp4
apr-util
openEuler:24.03-LTS-SP1
From an advisory covering 5 CVEs
 before 1.6.4-1.oe2403sp1
1.6.4-1.oe2403sp1
apr-util
openEuler:24.03-LTS-SP3
From an advisory covering 5 CVEs
 before 1.6.4-1.oe2403sp3
1.6.4-1.oe2403sp3
apr-util
openEuler:24.03-LTS-SP4
From an advisory covering 5 CVEs
 before 1.6.5-1.oe2403sp4
1.6.5-1.oe2403sp4
apr-util
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 1.6.3-160000.3.1
1.6.3-160000.3.1
apr-util
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 1.6.3-160000.3.1
1.6.3-160000.3.1
libapr-util1
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 4 CVEs
 before 1.5.3-8.22.1
1.5.3-8.22.1
libapr-util1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 1.5.3-8.22.1
1.5.3-8.22.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 6 CVEs
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 6 CVEs
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 1.6.3-160000.3.1
1.6.3-160000.3.1

History

History
RecordedChangedSources
affected, facts
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34191 is a critical vulnerability (CVSS 9.1) in Apache Software Foundation Portable Runtime Utility, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in apr-util 1.6.4-r0.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open