You are viewing a plain text version of this content. The canonical link for it is here.

Posted to announce@apache.org by Eric Covener <co...@apache.org> on 2026/08/06 14:06:24 UTC

CVE-2026-34502: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client

Severity: moderate 

Affected versions:

- Apache Portable Runtime Utility 1.3.0 through 1.6.3

Description:

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.

Credit:

Elhanan Haenel (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-34502

Timeline:

2026-03-27: reported
2026-08-06: fixed in 1.6.x by r1936813