{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34502", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-30T13:24:37.974Z", "datePublished": "2026-08-06T14:31:07.682Z", "dateUpdated": "2026-08-06T21:56:10.337Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Elhanan Haenel"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client</p><p>This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.<br></p>"}], "value": "Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3."}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:31:07.682Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-03-27T12:00:00.000Z", "value": "reported"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936813"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "title": "Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T15:29:06.379641Z", "id": "CVE-2026-34502", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T15:29:18.832Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:10.337Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:10.337Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-34502", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T15:29:06.379641Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T15:29:16.308Z"}}], "cna": {"title": "Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Elhanan Haenel"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Portable Runtime Utility", "versions": [{"status": "affected", "version": "1.3.0", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-27T12:00:00.000Z", "value": "reported"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936813"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "references": [{"url": "https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.", "supportingMedia": [{"type": "text/html", "value": "<p>Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client</p><p>This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.<br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:31:07.682Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34502", "state": "PUBLISHED", "dateUpdated": "2026-08-06T21:56:10.337Z", "dateReserved": "2026-03-30T13:24:37.974Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-06T14:31:07.682Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "1.3.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*", "matchCriteriaId": "69BDF76B-E0E3-4319-9F1B-83D579E41312", "versionEndIncluding": "1.6.3", "versionStartIncluding": "1.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3."}], "id": "CVE-2026-34502", "lastModified": "2026-08-07T19:58:31.823", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34502", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T15:29:06.379641Z", "version": "2.0.3"}}]}, "published": "2026-08-06T15:16:54.920", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/08/06/12"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client", "id": "2512083", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512083"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.", "A flaw was found in the memcached client in the Apache Portable Runtime Utility (apr-util). A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "Restrict network access for applications that use the `apr-util` memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect."}, "name": "CVE-2026-34502", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-06T14:31:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34502\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34502\nhttps://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8"], "statement": "The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application \u2014 they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.3.0,1.6.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Portable Runtime Utility", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "portable_runtime_utility", "vendor": "apache"}], "created": "2026-08-06T15:45:02.706612+00:00", "updated": "2026-08-13T10:45:04.023664+00:00", "vendors": ["apache", "apache$PRODUCT$portable_runtime_utility"]}