SQL injection in Apache Portable Runtime Utility apr_dbd_oracle provider (CVE-2026-34191)

An SQL injection vulnerability exists in the Apache Portable Runtime Utility library via the apr_dbd_oracle provider, caused by improper neutralization of special elements in SQL commands. An attacker capable of influencing SQL input through this provider may be able to manipulate database queries. Affected versions: - Apache Portable Runtime Utility 1.6.0 through 1.6.3 We recommend updating to: fixed in 1.6.x by r1936817. CVSS 9.1 · our assessment: act_now Reference: https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf Details: https://vuln.today/cve/CVE-2026-34191