Timing Attack Vulnerability in APR-util Affecting Apache Software Foundation
CVE-2025-49506

7.5HIGH

Key Information:

Vendor

Apache
Status
Apache Portable Runtime Utility
Vendor
CVE Published:
6 August 2026

What is CVE-2025-49506?

The APR-util library versions 1.6.3 and earlier are susceptible to a timing attack due to the apr_password_validate() function not executing in constant time during password and hash comparisons. This vulnerability could expose hashed passwords or their contents through side channel timing leaks, particularly on platforms that lack secure crypt() functions, such as Windows, BeOS, NetWare, and Android. Users are strongly urged to upgrade to version 1.6.4 to remedy this security flaw.

Affected Version(s)

Apache Portable Runtime Utility 1.2.0 <= 1.6.3

References

https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xf...
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Michael Rowley <michael csirt.global>
.