CVE-2026-34191 Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
SQL injection vulnerability in the apr_dbd_oracle provider allows attackers to manipulate database queries, potentially leading to unauthorized data access or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34191?
CVE-2026-34191 is a critical SQL injection vulnerability in Apache Portable Runtime Utility, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Weakness: CWE-89
Which versions are affected by CVE-2026-34191?
1 open source package ship an affected version, including apr-util. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apr-util Bitnami | From 1.6.0 | 1.6.5 |
Products include Apache Apr-Util.
How do I fix CVE-2026-34191?
Upgrade apr-util to 1.6.5 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-34191 being exploited?
There is no known exploitation of CVE-2026-34191 in the wild and no public exploit code.
Other vulnerabilities in Apache Portable Runtime Utility
- CVE-2009-2412 Integer overflow in n/a
- CVE-2026-32327 Apache Portable Runtime Utility: apr-util XML stack recursion crash
- CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
- CVE-2026-34501 Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
- CVE-2026-34502 Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Sources
Also known as ALPINE-CVE-2026-34191, BELL-CVE-2026-34191, BIT-apr-util-2026-34191, DEBIAN-CVE-2026-34191, ECHO-7cdd-31d1-19a0, GHSA-39fj-527g-2hph.