CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Eric Covener <[email protected]>
Newsgroups gmane.comp.apache.apr.devel
Message-ID <[email protected]> 
Severity: important 

Affected versions:

- Apache Portable Runtime Utility 1.6.0 through 1.6.3

Description:

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Credit:

Elhanan Haenel (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34191

Timeline:

2026-03-24: reported
2026-08-06: fixed in 1.6.x by r1936817
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.