Timing Attack Vulnerability in APR-util Affecting Apache Software Foundation

CVE-2025-49506

What is CVE-2025-49506?

The APR-util library versions 1.6.3 and earlier are susceptible to a timing attack due to the apr_password_validate() function not executing in constant time during password and hash comparisons. This vulnerability could expose hashed passwords or their contents through side channel timing leaks, particularly on platforms that lack secure crypt() functions, such as Windows, BeOS, NetWare, and Android. Users are strongly urged to upgrade to version 1.6.4 to remedy this security flaw.

References