SQL injection in Apache APR-util - CVE-2026-34191

Vulnerability identifier: #VU144928

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34191

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform SQL injection.

The vulnerability exists due to improper neutralization of special elements used in an SQL command in the apr_dbd_oracle provider when processing SQL commands. A remote attacker can supply crafted input to perform SQL injection.

Apache APR-util
openEuler
apr-util-pgsql
apr-util-odbc
apr-util-devel
apr-util-debugsource
apr-util-debuginfo
apr-util

Install security update from vendor's website.

Apache APR-util - update to 1.6.4
apr-util-pgsql - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-odbc - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-devel - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debugsource - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debuginfo - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1

• https://lists.apache.org/api/email.lua?id=6bywtxs2cbjx6frrqvj99qrjtbrkv307
• https://apr.apache.org/

• Multiple vulnerabilities in Apache APR-util
• openEuler 24.03 LTS SP3 update for apr-util
• openEuler 24.03 LTS SP1 update for apr-util
• openEuler 22.03 LTS SP4 update for apr-util
• openEuler 20.03 LTS SP4 update for apr-util
• openEuler 24.03 LTS SP4 update for apr-util