Skip to main content

APR-util CVE-2026-34191

| EUVDEUVD-2026-53918 CRITICAL
SQL Injection (CWE-89)
2026-08-06 apache GHSA-39fj-527g-2hph
Apache SQLi Apache Portable Runtime Utility Red Hat Suse
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
9.1 CRITICAL

Injection is network-reachable via the fronting application with no auth or interaction, yielding database read and write (C:H/I:H) but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Aug 06, 2026 - 22:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 06, 2026 - 22:22 vuln.today
cvss_changed
CVSS changed
Aug 06, 2026 - 22:22 NVD
9.1 (CRITICAL)
Analysis Generated
Aug 06, 2026 - 15:54 vuln.today
CVE Published
Aug 06, 2026 - 14:32 cve.org
HIGH

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

AnalysisAI

SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target application be built and configured to use APR-util's apr_dbd_oracle DBD provider against an Oracle database, and that attacker-controlled input reach a query handled by that provider - the Oracle provider must actually be compiled in and in use, which is a non-default, uncommon deployment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are mixed and require careful reading. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade APR-util to a fixed release above 1.6.3 once available from the Apache APR project; a released patched version is not independently confirmed from the provided data, so consult the Apache advisory at https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf and the oss-security thread at https://seclists.org/oss-sec/2026/q3/464 for the exact fixed version before deploying. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running APR-util 1.6.0 through 1.6.3 connected to Oracle databases and assess their data sensitivity; enable detailed query logging and establish real-time alerts for unusual SQL patterns. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Apache Portable Runtime Utility

View all
CVE-2026-34501 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated att
CVE-2026-34502 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3
CVE-2026-32327 CRITICAL
9.1 Aug 06

Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library throug
CVE-2025-49506 HIGH
7.5 Aug 06

Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-a

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

CVE-2026-34191 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy