{"id":"CVE-2026-34191","aliases":["ALPINE-CVE-2026-34191","BELL-CVE-2026-34191","BIT-apr-util-2026-34191","DEBIAN-CVE-2026-34191","EUVD-2026-53918","GHSA-39fj-527g-2hph","MGASA-2026-0364","OESA-2026-3325","OESA-2026-3326","OESA-2026-3327","OESA-2026-3328","OESA-2026-3409","ROOT-OS-DEBIAN-11-CVE-2026-34191","ROOT-OS-DEBIAN-12-CVE-2026-34191","ROOT-OS-DEBIAN-13-CVE-2026-34191","SUSE-SU-2026:23551-1","SUSE-SU-2026:3905-1","SUSE-SU-2026:3937-1","SUSE-SU-2026:3938-1","UBUNTU-CVE-2026-34191","openSUSE-SU-2026:21672-1"],"status":"published","title":"Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00587,"percentile":0.48353,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-08-06T14:32:24Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"apr-util","fixed_in":["1.6.4-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"apr-util","fixed_in":["1.6.5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"apr-util","fixed_in":["1.6.3-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"apr-util","fixed_in":["1.6.3-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"apr-util","fixed_in":["1.6.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.1-r13"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.3-r2"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.1-r13"},{"fixed":"1.6.4-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"apr-util","ranges":[{"type":"SEMVER","events":[{"introduced":"1.6.0"},{"fixed":"1.6.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1+deb12u1"}]}],"versions":["1.6.3-1"]},{"source":"osv","ecosystem":"Debian:13","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3+deb13u1"}]}],"versions":["1.6.3-3"]},{"source":"osv","ecosystem":"Debian:14","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1"}]}],"versions":["1.6.3-3","1.6.3-4"]},{"source":"osv","ecosystem":"Mageia:10","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-3.1.mga10"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:9","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-1.1.mga9"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.oe2003sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-16.oe2203sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1.oe2403sp1"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1.oe2403sp3"}]}],"bundled":5},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.oe2403sp4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160000.3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-8.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libapr-util1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-8.22.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150300.18.8.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1-150600.27.3.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"apr-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.3-160000.3.1"}]}],"bundled":5}],"products":[{"vendor":"apache","product":"apr-util"},{"vendor":"apache software foundation","product":"apache portable runtime utility"}],"references":[{"url":"https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf","tags":["vendor-advisory","Mailing List","Vendor Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/06/10","tags":["Mailing List","Third Party Advisory","advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34191","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-39fj-527g-2hph"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-34191","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-34191","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34191.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34191","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0364.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36181","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VKNIDBBNHOGIQ7XPC4JGLXADWZC3JEUN/","tags":["web"]},{"url":"https://lists.debian.org/debian-security-announce/2026/msg00348.html","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49506","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32327","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34501","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34502","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3326","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3327","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3328","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3409","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623551-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1274235","tags":["report"]},{"url":"https://bugzilla.suse.com/1274237","tags":["report"]},{"url":"https://bugzilla.suse.com/1274850","tags":["report"]},{"url":"https://bugzilla.suse.com/1274852","tags":["report"]},{"url":"https://bugzilla.suse.com/1274854","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-32327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-34502","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263905-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263937-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1207866","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-25147","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263938-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34191","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34191","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-34191","title":"Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T14:32:24.362Z","modified":"2026-08-06T21:56:08.447Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-53918","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T14:32:24Z","modified":"2026-08-06T21:56:08Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:02:07.757838Z"}],"ghsa":[{"id":"GHSA-39fj-527g-2hph","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T15:32:45Z","modified":"2026-08-07T00:32:15Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:10:11.041675Z"}],"nvd":[{"id":"CVE-2026-34191","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T15:16:54.65Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"ALPINE-CVE-2026-34191","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T15:16:54.65Z","modified":"2026-10-01T02:17:49.253843886Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2026-34191","status":"published","published":"2026-08-09T07:59:07.177962Z","modified":"2026-08-12T07:15:09.122342888Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:28:23.572955Z"},{"id":"CVE-2026-34191","title":"Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T14:32:24.362Z","modified":"2026-10-28T02:30:46.183287192Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"DEBIAN-CVE-2026-34191","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.  This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-06T15:16:54.65Z","modified":"2026-10-25T09:47:34.510234704Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-3325","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:42Z","modified":"2026-08-16T01:45:09.284764782Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3326","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:47Z","modified":"2026-08-16T01:45:16.261586776Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3327","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:51Z","modified":"2026-08-16T01:45:15.831923006Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3328","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-13T13:57:55Z","modified":"2026-08-16T01:45:09.238710768Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3409","title":"apr-util security update","description":"The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.\r\n\r\nSecurity Fix(es):\n\nAPR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)\n\nA bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)\n\nImproper Neutralization of Special Elements used in an SQL Command (\u0026apos;SQL Injection\u0026apos;) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)\n\nHeap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)","status":"published","published":"2026-08-20T09:54:47Z","modified":"2026-08-20T10:15:07.665212157Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"UBUNTU-CVE-2026-34191","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"withdrawn","published":"2026-08-06T15:16:00Z","modified":"2026-09-28T17:30:04.876105407Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"BIT-apr-util-2026-34191","title":"Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3","status":"published","published":"2026-08-17T05:36:32.88Z","modified":"2026-09-08T08:45:44.880750633Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"MGASA-2026-0364","title":"Updated apr-util packages fix security vulnerabilities","description":"Apache Portable Runtime Utility: apr_password_validate() vulnerable to\ntiming attack. (CVE-2025-49506)\nApache Portable Runtime Utility: apr-util XML stack recursion crash.\n(CVE-2026-32327)\nApache Portable Runtime Utility: SQL Injection in apr_dbd_oracle.\n(CVE-2026-34191)\nApache Portable Runtime Utility: Heap buffer overflow in APR redis\nclient. (CVE-2026-34501)\nApache Portable Runtime Utility: Heap buffer overflow in APR memcached\nclient. (CVE-2026-34502)\n","status":"published","published":"2026-09-02T16:59:28Z","modified":"2026-09-02T17:00:05.828867227Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:21672-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2025-49506: hash/password content leak via side channel timing attack against `apr_password_validate()`\n  (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL injection via `apr_dbd_oracle` (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-08-28T08:23:34Z","modified":"2026-08-30T13:00:03.962053974Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-34191","title":"CVE-2026-34191 in apr-util - Patched by Root","description":"Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:11. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-20T12:05:24Z","modified":"2026-10-12T07:00:05.470711453Z","updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-34191","title":"CVE-2026-34191 in apr-util - Patched by Root","description":"Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-25T08:24:31Z","modified":"2026-10-09T13:00:12.574395276Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-34191","title":"CVE-2026-34191 in apr-util - Patched by Root","description":"Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-23T14:06:54Z","modified":"2026-10-08T13:00:07.336289333Z","updated_at":"2026-11-02T15:53:33.415244Z"},{"id":"SUSE-SU-2026:23551-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2025-49506: hash/password content leak via side channel timing attack against `apr_password_validate()`\n  (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL injection via `apr_dbd_oracle` (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-08-28T08:24:33Z","modified":"2026-09-29T18:23:08.353385664Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3905-1","title":"Security update for libapr-util1","description":"This update for libapr-util1 fixes the following issues:\n\n- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-09-01T08:36:02Z","modified":"2026-09-10T18:23:17.458411857Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3937-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).\n- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-09-03T07:29:20Z","modified":"2026-09-10T18:23:18.062427971Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:3938-1","title":"Security update for apr-util","description":"This update for apr-util fixes the following issues:\n\n- CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).\n- CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).\n- CVE-2026-32327: XML stack recursion crash (bsc#1274235).\n- CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).\n- CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).\n- CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).\n","status":"published","published":"2026-09-03T07:30:47Z","modified":"2026-09-10T18:23:18.07394636Z","updated_at":"2026-11-02T15:54:05.392906Z"}]}}