CVE-2025-49506CWE-208

CVE-2025-49506

High · published August 6, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-208 · Observable Timing Discrepancy
Published
2026-08-06T19:16Z
Affected products (1)
ProductVersionsFixed in
apache/apr-util≥ 1.2.0, < 1.6.41.6.4
References (2)
https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5 · [email protected]http://www.openwall.com/lists/oss-security/2026/08/06/8 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 06 AUG 14:33Z
    Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
    cvelistv5