CVE-2025-49506

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/8	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-08-06 15:16

Updated : 2026-08-07 19:44

NVD link : CVE-2025-49506

Mitre link : CVE-2025-49506

CVE.ORG link : CVE-2025-49506

JSON object : View

Products Affected

apache

apr-util

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2025-49506", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49506", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T17:45:19.290280Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Portable Runtime Utility", "versions": [{"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "packageName": "APR-util", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T15:16:41.890", "references": [{"url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/06/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as\u00a0\u00a0Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}], "lastModified": "2026-08-07T19:44:52.410", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BB400D3-9995-461D-9DCD-EBB95F8D6377", "versionEndExcluding": "1.6.4", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}