High severity · published Aug 6, 2026
CVE-2025-49506
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apache Portable Runtime Utility · Apache Software Foundation
1.2.0 through 1.6.3 · source: vendor
AP
Apr-util · Apache
1.2.0 before 1.6.4 · source: NVD
Affected product
AP
Apache Portable Runtime Utility
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-49506
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-49506
Mailing List
https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5
Mailing List
http://www.openwall.com/lists/oss-security/2026/08/06/8
More from Apache Portable Runtime Utility
9.1
CVE-2026-32327
Apache Portable Runtime Utility: apr-util XML stack recursion crash
9.1
CVE-2026-34191
Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
7.5
CVE-2026-34501
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
7.5
CVE-2026-34502
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client