CVE-2026-34502: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

[Eric Covener <covener () apache org>]

Severity: moderate 

Affected versions:

- Apache Portable Runtime Utility 1.3.0 through 1.6.3

Description:

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

Credit:

Elhanan Haenel (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34502

Timeline:

2026-03-27: reported
2026-08-06: fixed in 1.6.x by r1936813