Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 2 vendors · 2 advisories

CVE-2026-34501

CVE-2026-34501: 2 tracked advisory records across Apache, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

1 advisory

Red Hat

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-34501] Heap buffer overflow in redis client

    CVE-2026-34501Source published Source updated

    Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. Users are recommended to upgrade to version 1.6.4, which fixes the issue. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service. The impact of this vulnerability is rated as Moderate. Although the flaw involves a heap buffer overflow and the CVSS base score reflects an unauthenticated network vector, exploitation requires the attacker to control or compromise the Redis server that the application queries. An attacker cannot trigger this condition by sending data directly to the affected application — they must first be in a position to influence Redis responses, either by compromising the…

    Affected products in this advisory
    • Red Hat Enterprise Linux 10
    • Red Hat Enterprise Linux 9
    • Red Hat Hardened Images
    • Red Hat Enterprise Linux 6

    3 more entries in the full advisory.

    Source-reported affected versions
    • 1.6.0
    • 1.6.3
    Source-reported fixed versions
    • 1.6.4
    • apr-util-0:1.6.3-23.el10_2.1
    • apr-util-0:1.6.1-23.el9_8.1
    • apr-util-main-1.6.5-1.hum1

    3 more entries in the full advisory.

    Mitigation guidance
    • Ensure that the Redis server used by the application is deployed in a trusted, network-segregated environment and is not accessible to untrusted parties. Where possible, configure authentication and TLS on the Redis connection to reduce the risk of a compromised or spoofed Redis server.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features