CVE-2026-34191: Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

[Eric Covener <covener () apache org>]

Severity: important 

Affected versions:

- Apache Portable Runtime Utility 1.6.0 through 1.6.3

Description:

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable 
Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Credit:

Elhanan Haenel (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34191

Timeline:

2026-03-24: reported
2026-08-06: fixed in 1.6.x by r1936817