Severity: important
Affected versions:
- Apache Portable Runtime Utility 1.6.0 through 1.6.3
Description:
Improper Neutralization of Special Elements used in an SQL Command ('SQL
Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle
provider.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Credit:
Elhanan Haenel (finder)
References:
https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34191
Timeline:
2026-03-24: reported
2026-08-06: fixed in 1.6.x by r1936817
