Loading story…
Apache disclosed CVE-2026-34191, an important-severity SQL injection vulnerability in Apache Portable Runtime Utility (APR-util) affecting versions 1.6.0 through 1.6.3. The flaw is located in the apr_dbd_oracle provider, exposing applications that rely on that component for Oracle database interactions to SQL injection risk.
The issue was reported by Elhanan Haenel on 2026-03-24 and fixed in the 1.6.x branch on 2026-08-06 with revision r1936817, according to Apache advisories published through the Apache mailing lists and mirrored on oss-security and Openwall. Organizations using APR-util with the Oracle DBD provider should identify affected deployments and update to a release containing the fix.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-06, Apache publicly disclosed CVE-2026-34191 as an important-severity SQL injection vulnerability in the apr_dbd_oracle provider of Apache Portable Runtime Utility. The disclosure stated that versions 1.6.0 through 1.6.3 are affected.
Apache fixed CVE-2026-34191 on 2026-08-06 in the 1.6.x branch of Apache Portable Runtime Utility. The fix was identified as revision r1936817.
Apache Portable Runtime Utility's SQL injection flaw in the apr_dbd_oracle provider was reported on 2026-03-24. Apache credited Elhanan Haenel as the finder of the issue affecting versions 1.6.0 through 1.6.3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcelists.apache.org
Open sourcecve.org
Open sourceopenwall.com
Open sourceapr.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle’s April 2017 Critical Patch Update addressed **CVE-2017-3599**, a remotely exploitable, pre-authentication denial-of-service vulnerability in MySQL. An unauthenticated attacker could send crafted network traffic to an exposed MySQL service and cause it to become unavailable, affecting database-backed applications and dependent business services. Organizations running affected Oracle MySQL deployments should apply the relevant Oracle CPU updates, prioritize internet- or partner-accessible database servers, and restrict MySQL network exposure to authorized hosts. Security teams should also monitor for abnormal or malformed connection activity and validate service availability after patching.
Aug 29, 2026
Apache InLong disclosed **CVE-2026-63038**, an important-severity SQL injection vulnerability caused by unsafe string concatenation in SQL command handling. The flaw affects Apache InLong versions `2.0.0` through before `2.4.0` and allows attackers to inject arbitrary SQL code through the `dbName`, `tableName`, `schemaName`, and `username` parameters. The Apache project advised users to upgrade to **Apache InLong 2.4.0** or cherry-pick the published fix to remediate the issue. The vulnerability was reported by Charles Zhang, and credit for identifying it was given to **zhaokaifei**.
Aug 20, 2026
Oracle-related security advisories were issued for multiple enterprise products, including **Oracle Database Server**, **Oracle Fusion Middleware**, **Oracle REST Data Services**, **Oracle Java SE**, **Oracle Financial Services Applications**, and **Oracle E-Business Suite**. Germany's dCERT published separate advisories for each affected product line, indicating broad exposure across core Oracle infrastructure and business application environments. One of the disclosed flaws, **`CVE-2026-34275`**, affects the **Setup and Administration** component of **Oracle Advanced Inbound Telephony** in **Oracle E-Business Suite** versions **12.2.3 through 12.2.15**. Oracle rated the issue **critical** with a **CVSS v3.1 score of 9.8**, stating that an **unauthenticated attacker** with **network access over HTTP** could exploit it to achieve **full takeover** of the affected application. The vulnerability was disclosed as part of Oracle's broader Critical Patch Update, underscoring the need for organizations running Oracle platforms to prioritize patch review and remediation across exposed systems.
Jun 29, 2026