CVE-2025-49506

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Score

CVSS 3.1 7.5 High

Status

Analyzed - security@apache.org

Published

2026-08-06

Last modified

2026-08-06

Weaknesses

CWE-208

Affected products

• Apr-util (Apache)
• Apache Portable Runtime Utility (Apache Software Foundation)

References

• https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5
• http://www.openwall.com/lists/oss-security/2026/08/06/8