SQL Injection Vulnerability in Apache Portable Runtime Utility (apr-util)

apr-util Updated 07 Aug 2026

Summary

06/08/2026

Disclosed on

N/A

Severity

Yes i

Fix available

Critical

Severity

9.1

CVSS Score

ALPINE-CVE-2026-34191: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. Affects apr-util versions < 1.6.4-r0. Fixed in 1.6.4-r0. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Apache Portable Runtime Utility (apr-util) is a library that provides a set of APIs to facilitate the development of portable applications. It is widely used in various software projects to handle system-level tasks such as memory management, file I/O, and network communication. The library's functionality is crucial for applications that require a consistent interface across different operating systems. However, certain versions of apr-util are vulnerable to SQL injection attacks, which can compromise the security of applications relying on this library.

Vulnerability Detail

The vulnerability identified as CVE-2026-34191 is an SQL Injection issue in the apr_dbd_oracle provider of the Apache Portable Runtime Utility. This flaw arises from improper neutralization of special elements used in SQL commands, allowing attackers to manipulate SQL queries executed by the application. If exploited, this vulnerability could lead to unauthorized access to sensitive data, data corruption, or even complete system compromise. The affected versions range from 1.6.0 to 1.6.3, making it critical for users to address this issue promptly.

How To Fix

Minimum fixed version

1.6.4-r0

This is the first release that contains the fix.

sudo apk add --upgrade apr-util

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If immediate updating is not feasible, consider implementing input validation and sanitization in your application to mitigate the risk of SQL injection attacks. Additionally, restrict database permissions to limit the impact of potential exploitation.

Conclusion

The SQL injection vulnerability in Apache Portable Runtime Utility poses significant risks to applications that utilize this library. It is essential for users to update to the patched version to safeguard their systems against potential attacks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your software.

See every vulnerability recorded for apr-util →