VulnSocial

CVE-2026-34501General(apache / apr-util)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

apache CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • apr-util

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 1 signal
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-08-06); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
apache
Products
apr-util

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-08-06: 1Mentions · 2026-08-09: 1Technical Details · 2026-08-09: 108-0608-09
Signal classification2 categories
General
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-08-061
General1
2026-08-091
Disclosure1
Full discourse2 posts
  • connect24h@connect24h
    Disclosure

    うわ、APRで3連発はしんどい。 Apache Portable Runtime Utilityで、apr_dbd_oracleのSQL Injection（CVE-2026-34191）、Redis clientとmemcached clientのheap buffer overflow（CVE-2026-34501、CVE-2026-34502）が公開された。共通部品だけに、アプリ名だけ眺めても拾えないのが嫌らしい。 私の資産台帳も、apr-utilの導入version、runtimeで有効なDBD driver、Redis・memcached clientの利用有無まで持たせることにする。Oracle・Redis・memcachedを使う環境は、直接依存だけでなく間接依存とlinked libraryまで見える状態にしておいた方が良い。 ソース: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34191

    Post summary

    The post announces the publication of three CVEs affecting Apache APR, Redis, and memcached, providing concise technical details but no exploit code, PoC, or patch information.

    01000451
    5.7K followersView on X
  • VulDB 🛡@vuldb
    General

    A severe vulnerability was disclosed for Apache Portable Runtime Utility (CVE-2026-34501) https://vuldb.com/vuln/386598

    Post summary

    The post announces that CVE-2026-34501, a severe vulnerability in Apache Portable Runtime Utility, has been disclosed, but it provides no technical or operational details.

    00000125
    2.3K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appapacheapr-util---

Explore more

Back to dashboardapache CVEsapr-util vulnerabilities