CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
Published Aug 6, 2026
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Affected Software
2 affected components
Apache Apache Portable Runtime Utility>=1.6.0<=1.6.3
Apache apr-util>=1.6.0<=1.6.3
Event History
Aug 6, 2026
CVE Published
via MITRE·02:32 PM
Data Sourced
via MITRE·02:32 PM
DescriptionWeakness
Data Sourced
via OSV·02:32 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-34191?
CVE-2026-34191 has a risk severity rating of 56.
2
How do I fix CVE-2026-34191?
To fix CVE-2026-34191, upgrade Apache Portable Runtime Utility to version 1.6.4 or later.
3
What impact does CVE-2026-34191 have?
CVE-2026-34191 allows for SQL injection, potentially compromising the database through incorrect handling of SQL commands.
4
Which versions of Apache Portable Runtime Utility are affected by CVE-2026-34191?
CVE-2026-34191 affects Apache Portable Runtime Utility versions from 1.6.0 through 1.6.3.
5
Is CVE-2026-34191 related to a specific database provider?
Yes, CVE-2026-34191 is specifically related to the apr_dbd_oracle provider in the Apache Portable Runtime Utility.