CVE-2026-34191: Apache Apr-Util

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Affected products

• Apache Apr-Util: from 1.6.0, up to and including 1.6.3

Published 2026-08-06. Last modified 2026-08-07.