p PatchFirst

CVE-2026-34191

CVE-2026-34191 · Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

CVSS 9.1 · Critical · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • apache portable runtime utility

    Versions
    • ≥ 1.6.0, ≤ 1.6.3: Affected (semver)

    No fix published

  • apr-util Debian:12

    Versions
    • 1.6.3-1
    Affected ranges
    • ECOSYSTEM: < 1.6.3-1+deb12u1

    Update to 1.6.3-1+deb12u1

  • apr-util Debian:13

    Versions
    • 1.6.3-3
    Affected ranges
    • ECOSYSTEM: < 1.6.3-3+deb13u1

    Update to 1.6.3-3+deb13u1

  • apr-util Debian:14

    Versions
    • 1.6.3-3
    • 1.6.3-4
    Affected ranges
    • ECOSYSTEM: < 1.6.4-1

    Update to 1.6.4-1

Original sources

Check your server →