CVE-2026-34501: Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

Eric Covener <[email protected]>
Newsgroups gmane.comp.apache.apr.devel
Message-ID <[email protected]> 
Severity: moderate 

Affected versions:

- Apache Portable Runtime Utility 1.6.0 through 1.6.3

Description:

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.

Credit:

Elhanan Haenel (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34501

Timeline:

2026-03-27: reported
2026-08-06: fixed in 1.6.x by r1936810
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.