CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-10-24
Weakness: CWE-89

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Affected products

Apache Apr-Util: from 1.6.0 through 1.6.3

References

https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf
http://www.openwall.com/lists/oss-security/2026/08/06/10

Get alerted when CVE-2026-34191 or the next vulnerability affects your stack