Heap-based buffer overflow in Apache APR-util - CVE-2026-34501

Vulnerability identifier: #VU144929

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-34501

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to heap-based buffer overflow in the APR redis client when parsing redis server responses. A remote attacker can send specially crafted response data to execute arbitrary code.

Apache APR-util
Debian Linux
openEuler
apr-util-pgsql
apr-util-odbc
apr-util-devel
apr-util-debugsource
apr-util-debuginfo
apr-util
apr-util (Debian package)

Install security update from vendor's website.

Apache APR-util - update to 1.6.4
apr-util-pgsql - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-odbc - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-devel - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debugsource - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util-debuginfo - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util - addressed in versions 1.6.1-16, 1.6.4-1, 1.6.5-1
apr-util (Debian package) - update to 1.6.3-3+deb13u1

• https://lists.apache.org/api/email.lua?id=vqngjyyfzvbh4ppok9dr0q3cozjh2gpr
• https://apr.apache.org/

• Multiple vulnerabilities in Apache APR-util
• Debian update for apr-util
• openEuler 24.03 LTS SP3 update for apr-util
• openEuler 24.03 LTS SP1 update for apr-util
• openEuler 22.03 LTS SP4 update for apr-util
• openEuler 20.03 LTS SP4 update for apr-util
• openEuler 24.03 LTS SP4 update for apr-util