Back Linuxsecurity

openSUSE apr-util Critical Buffer Overflow SQL Injection Vuln 2026-3938

Linuxsecurity •LinuxSecurity Advisories • September 3, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

This update for apr-util fixes the following issues:

* CVE-2022-25147: buffer overflow possible with specially crafted input

* CVE-2025-49506: leaking content via side channel timing attack

* CVE-2026-32327: XML stack recursion crash (bsc#1274235).

* CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).

* CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).

* CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like

YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

* Basesystem Module 15-SP7

zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP7-2026-3938=1

* Server Applications Module 15-SP7

zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-3938=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6

zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-3938=1

zypper in -t patch SUSE-2026-3938=1

* SUSE Linux Enterprise Server 15 SP6 LTSS

zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-3938=1

* SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)

* libapr-util1-dbd-mysql-1.6.1-150600.27.3.1

* libapr-util1-dbd-pgsql-1.6.1-150600.27.3.1

* libapr-util1-dbd-mysql-debuginfo-1.6.1-150600.27.3.1

* libapr-util1-dbd-pgsql-debuginfo-1.6.1-150600.27.3.1

* libapr-util1-dbd-sqlite3-1.6.1-150600.27.3.1

* apr-util-debugsource-1.6.1-150600.27.3.1

* libapr-util1-debuginfo-1.6.1-150600.27.3.1

* apr-util-debuginfo-1.6.1-150600.27.3.1

* apr-util-devel-1.6.1-150600.27.3.1

* libapr-util1-1.6.1-150600.27.3.1

* libapr-util1-dbd-sqlite3-debuginfo-1.6.1-150600.27.3.1

* SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)

* libapr-util1-dbd-mysql-1.6.1-150600.27.3.1

* libapr-util1-dbd-pgsql-1.6.1-150600.27.3.1

* libapr-util1-dbd-mysql-debuginfo-1.6.1-150600.27.3.1

* libapr-util1-dbd-pgsql-debuginfo-1.6.1-150600.27.3.1

* libapr-util1-dbd-sqlite3-1.6.1-150600.27.3.1

* apr-util-debugsource-1.6.1-150600.27.3.1

* libapr-util1-debuginfo-1.6.1-150600.27.3.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in openSUSE apr-util Require Immediate Patching Multiple critical vulnerabilities have been identified in the Apache Portable Runtime Utility (apr-util) affecting openSUSE systems. Key issues include CVE-2026-34191, a SQL Injection vulnerability, and CVE-2026-34501 and CVE-2026-34502, both heap buffer overflows. These vulnerabilities can lead to unauthorized access and potential system crashes. The vulnerabilities were disclosed on August 6, 2026, and are present in various SUSE Linux Enterprise Server and openSUSE versions. Administrators are urged to apply patches immediately using the provided zypper commands. Mageia systems are also affected, with similar vulnerabilities reported. The urgency is heightened as exploitation in the wild is a possibility. Current advisories emphasize the need for prompt action to secure systems. 5 sources 72

Extracted Entities

openSUSE apr-util Critical Buffer Overflow SQL Injection Vuln 2026-3938

The full story

Extracted Entities

Attack Types (1)

CVEs (6)

CWE Weaknesses (3)

Platforms (2)