diff mbox series

[scarthgap,v3,3/5] apr-util: Mark CVE-2026-34191 not applicable

Message ID 20261015122721.2278428-3-hthakar@cisco.com
State New
Headers show
Series [scarthgap,v3,1/5] apr-util: Fix CVE-2025-49506 | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 15, 2026, 12:27 p.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

CVE-2026-34191 affects only the apr_dbd_oracle provider [1].
The apr-util recipe does not enable --with-oracle, so configure keeps
apu_have_oracle=0 [2]. Hence mark the CVE not applicable to this build.

[1] https://nvd.nist.gov/vuln/detail/CVE-2026-34191
[2] https://github.com/apache/apr-util/blob/1.6.3/build/dbd.m4

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 meta/recipes-support/apr/apr-util_1.6.3.bb | 2 ++
 1 file changed, 2 insertions(+)
diff mbox series

Patch

diff --git a/meta/recipes-support/apr/apr-util_1.6.3.bb b/meta/recipes-support/apr/apr-util_1.6.3.bb
index c721d35f61..4d5d4b8fe0 100644
--- a/meta/recipes-support/apr/apr-util_1.6.3.bb
+++ b/meta/recipes-support/apr/apr-util_1.6.3.bb
@@ -104,3 +104,5 @@  do_install_ptest() {
 
 # Add CVE_PRODUCT to match the NVD CPE product name
 CVE_PRODUCT = "apache:apr-util apache:portable_runtime_utility"
+
+CVE_STATUS[CVE-2026-34191] = "not-applicable-config: apr_dbd_oracle is not built because --with-oracle is not enabled"