Skip to main content

APR-util EUVDEUVD-2026-53918

| CVE-2026-34191 CRITICAL
SQL Injection (CWE-89)
2026-08-06 apache GHSA-39fj-527g-2hph
Apache SQLi Red Hat Suse Apache Portable Runtime Utility Apache Software Foundation
9.1
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
9.1 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
9.1 CRITICAL

Injection is network-reachable via the fronting application with no auth or interaction, yielding database read and write (C:H/I:H) but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
CRITICAL
qualitative
Red Hat
8.1 HIGH
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Aug 06, 2026 - 22:30 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 06, 2026 - 22:22 vuln.today
cvss_changed
CVSS changed
Aug 06, 2026 - 22:22 NVD
9.1 (CRITICAL)
Analysis Generated
Aug 06, 2026 - 15:54 vuln.today
CVE Published
Aug 06, 2026 - 14:32 cve.org
HIGH

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

AnalysisAI

SQL injection in the Apache Portable Runtime Utility (APR-util) affects the apr_dbd_oracle database provider in versions 1.6.0 through 1.6.3, letting remote attackers inject arbitrary SQL through an application that relies on this DBD backend for query construction or escaping. Rated CVSS 9.1 with high confidentiality and integrity impact but no availability impact, it allows unauthorized reading and modification of Oracle-backed data. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

APR-util is a companion library to the Apache Portable Runtime that provides higher-level portable services, including the apr_dbd database abstraction layer used by projects such as Apache httpd (mod_dbd/mod_authn_dbd) and other APR-based applications. The flaw is in the apr_dbd_oracle provider, one of the pluggable DBD backends that wraps Oracle's OCI client. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the provider fails to correctly neutralize special characters when building or escaping SQL, so parameter values that applications assume are safely bound or escaped can break out of their intended context. Because consuming applications trust apr_dbd for safe query handling, a defect at this layer silently undermines otherwise-correct application code.

RemediationAI

Upgrade APR-util to a fixed release above 1.6.3 once available from the Apache APR project; a released patched version is not independently confirmed from the provided data, so consult the Apache advisory at https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf and the oss-security thread at https://seclists.org/oss-sec/2026/q3/464 for the exact fixed version before deploying. As an immediate compensating control, avoid or disable the apr_dbd_oracle provider where the Oracle backend is not required (for example rebuild APR-util without the Oracle DBD driver, or switch mod_dbd/authn configurations to a non-Oracle provider), accepting the trade-off of losing Oracle connectivity for affected applications. Where the provider must remain in use, enforce strict server-side input validation and parameterized queries at the application layer and restrict which endpoints reach Oracle-backed queries, recognizing this only reduces rather than eliminates exposure since the defect is in the escaping layer itself.

More in Apache Portable Runtime Utility

View all
CVE-2026-34501 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's redis client component allows remote unauthenticated att
CVE-2026-34502 HIGH
7.5 Aug 06

Heap-based buffer overflow in Apache Portable Runtime Utility's memcached client component (versions 1.3.0 through 1.6.3
CVE-2026-32327 CRITICAL
9.1 Aug 06

Denial of service (and possibly information disclosure) in the Apache Portable Runtime Utility (APR-util) library throug
CVE-2025-49506 HIGH
7.5 Aug 06

Timing side-channel exposure in Apache Portable Runtime Utility (APR-util) versions 1.2.0 through 1.6.3 allows network-a

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8

Same technique SQLi

View all
CVE-2019-7481 HIGH POC
7.5
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected

Share

EUVD-2026-53918 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy