CVE-2026-34501: Apache Portable Runtime Utility: Heap buffer overflow in APR redis client

[Eric Covener <covener () apache org>]

Severity: moderate 

Affected versions:

- Apache Portable Runtime Utility 1.6.0 through 1.6.3

Description:

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.

Credit:

Elhanan Haenel (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34501

Timeline:

2026-03-27: reported
2026-08-06: fixed in 1.6.x by r1936810