CVE-2026-34501: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects

This month

HIGH 7.5REMOTEWATCHLISTUPGRADE

CVE-2026-34501 is a high-severity flaw (CVSS 7.5) affecting apr-util. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

Why this priority

High severity
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.5% (top 57%)
CISA exploited list	No
Weakness	CWE-122
Published	2026-08-06
Last modified	2026-10-23

Publisher (CNA): Apache Software Foundation · Vendor: apache

Am I affected?

Timeline

2026-08-06 15:16 UTCPublished CVE record published
2026-10-23 21:10 UTCUpdated Record last modified

apache apr-util UPGRADE

Affected: >= 1.6.0 and < 1.6.4

Fixed in: 1.6.4

Safe to downgrade to: a release before 1.6.0

1. Check installed version

apt-cache policy apr-util || rpm -q apr-util || apr-util --version

2. UPGRADE to 1.6.4 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade apr-util

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade apr-util

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 1.6.0 (Debian / Ubuntu)

apt-cache madison apr-util sudo apt install apr-util=<VERSION_BEFORE_1.6.0> sudo apt-mark hold apr-util

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list apr-util sudo dnf downgrade apr-util-<VERSION_BEFORE_1.6.0> sudo dnf versionlock add apr-util

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · rubygem-eventmachine · FIXED · 1.2.7-37.fc46 · FEDORA-2026-7194c202a2 · source

sudo dnf upgrade --advisory=FEDORA-2026-7194c202a2

Debian 12 · apr-util · FIXED · 1.6.3-1+deb12u1

sudo apt update && sudo apt install --only-upgrade apr-util dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apr-util)" ge "1.6.3-1+deb12u1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · apr-util · FIXED · 1.6.3-3+deb13u1

sudo apt update && sudo apt install --only-upgrade apr-util dpkg --compare-versions "$(dpkg-query -W -f='${Version}' apr-util)" ge "1.6.3-3+deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · apr-util · FIXED · apr-util-1.6.3-23.el10_2.1

sudo dnf upgrade --advisory=RHSA-2026:66392 rpm -q apr-util

RHEL 8 · apr-util · FIXED · apr-util-1.6.1-9.el8_10.1

sudo dnf upgrade --advisory=RHSA-2026:69113 rpm -q apr-util

RHEL 9 · apr-util · FIXED · apr-util-1.6.1-23.el9_8.1

sudo dnf upgrade --advisory=RHSA-2026:66341 rpm -q apr-util

RHEL 6 · apr-util · DEFERRED

RHEL 7 · apr-util · NO FIX YET

Alpine 3.21 · apr-util · FIXED · apr-util-1.6.4-r0

apk add --upgrade apr-util apk info -v apr-util

Alpine 3.22 · apr-util · FIXED · apr-util-1.6.4-r0

apk add --upgrade apr-util apk info -v apr-util

Alpine 3.23 · apr-util · FIXED · apr-util-1.6.4-r0

apk add --upgrade apr-util apk info -v apr-util

Alpine 3.24 · apr-util · FIXED · apr-util-1.6.4-r0

apk add --upgrade apr-util apk info -v apr-util

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2026-2115 · source

sudo dnf update --advisory=ALAS2023-2026-2115

Amazon Linux 2 · see advisory · FIXED · ALAS2-2026-3892 · source

sudo yum update --advisory=ALAS2-2026-3892

Advisories and coverage

Official advisories

Amazon Linux 2 ALAS: ALAS2-2026-3892 (important): apr-util 2026-08-31

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Related CVEs

CVE-2026-34191 CRITICAL 9.1 UPGRADE Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache P
CVE-2026-32327 CRITICAL 9.1 UPGRADE A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer whi
CVE-2026-34502 HIGH 7.5 UPGRADE Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affec

References

← Back to latest CVEs