CVE-2026-34191

Critical

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.003; 28th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 157; of 17,781 indexed, latest versions
Container images: 161; deployed by those charts
Fix available: 3 of 3; affected packages

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Carried by container images the latest versions of 157 of 17,781 indexed charts deploy, on 161 images.

Affected package	Affected versions	Fixed in	Images
apr-utildeb	1.6.1-4ubuntu2, 1.6.1-4ubuntu2.2, 1.6.1-5ubuntu4.22.04.2, 1.6.3-1+4 more	1.6.3-1+deb12u1, 1.6.3-3+deb13u1	151
apr-utilapk	1.6.3-r1, 1.6.3-r2	1.6.4-r0	8
apr-utilbitnami	1.6.3	1.6.5	2

OSV records: ALPINE-CVE-2026-34191 BIT-apr-util-2026-34191 DEBIAN-CVE-2026-34191 UBUNTU-CVE-2026-34191

Charts affected

157 by stars

Chart

Latest

Affected images

Radar Score

docsumtest-opea

1.0.0

1 of 5 See more

docsum test-opea 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
opea/docsum-ui :1.0	7f854e9bffaf	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

28,858

nextcloudth-charts

0.4.0

1 of 1 See more

nextcloud th-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
library/nextcloud :31.0.6-apache	588609d76b21	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

10,086

owncloudth-charts

0.2.1

1 of 1 See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
owncloud/server :10.15.0	51d9b74fc2a8	apr-util@1.6.1-4ubuntu2.2	no fix listed

Open the chart page →

10,006

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

17,323

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

14,358

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

10,001

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2026-34191.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	apr-util@1.6.1-5ubuntu4.22.04.2	no fix listed

Open the chart page →

7,849

Container images carrying it

161 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
ghcr.io/zoriya/kyoo_autosync :4.7.1	fbba58ddb1a6	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	apr-util@1.6.1-4ubuntu2	no fix listed	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	apr-util@1.6.3-1	1.6.3-1+deb12u1	1