CVE-2025-49506: Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-06 · updated 2026-09-29
Weakness: CWE-208

Description

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Affected products

Apache Apr-Util: from 1.2.0 before 1.6.4 — fixed in 1.6.4

How to fix

Upgrade to a fixed version: Apache Apr-Util 1.6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-49506 or the next vulnerability affects your stack