Apache Portable Runtime Utility
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_portable_runtime_utility:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Portable Runtime Utility (f5732762-18b4-57b2-9f18-5979c7239a45) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-34501 |
vulnerable | 2026-09-16 04:33:47.193309 |
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.
Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Published: 2026-08-06T14:31:48.356Z
Updated: 2026-08-06T21:56:09.410Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34191 |
vulnerable | 2026-09-16 04:33:46.491046 |
Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3
Published: 2026-08-06T14:32:24.362Z
Updated: 2026-08-06T21:56:08.447Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34502 |
vulnerable | 2026-09-16 04:33:45.930057 |
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client
This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
Published: 2026-08-06T14:31:07.682Z
Updated: 2026-08-06T21:56:10.337Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-32327 |
vulnerable | 2026-09-16 04:33:17.053586 |
Apache Portable Runtime Utility: apr-util XML stack recursion crash
A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Published: 2026-08-06T14:32:43.526Z
Updated: 2026-08-06T21:56:07.488Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49506 |
vulnerable | 2026-09-16 04:27:06.793325 |
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Published: 2026-08-06T14:33:12.957Z
Updated: 2026-08-06T21:56:06.543Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.