CVE-2025-49506

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/06/8	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*

History

29 Sep 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) APR-util versiones 1.6.3 (y anteriores), la función apr_password_validate() no era de tiempo constante con respecto a las comparaciones de hashes o contraseñas, potencialmente filtrando su contenido a través de un ataque de temporización de canal lateral, particularmente en plataformas sin crypt() como Windows, BeOS, NetWare o Android. Se recomienda a los usuarios actualizar a la versión 1.6.4, que corrige este problema.

Information

Published : 2026-08-06 15:16

Updated : 2026-09-29 14:10

NVD link : CVE-2025-49506

Mitre link : CVE-2025-49506

CVE.ORG link : CVE-2025-49506

JSON object : View

Products Affected

apache

apr-util

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2025-49506", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49506", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T17:45:19.290280Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Portable Runtime Utility", "versions": [{"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "packageName": "APR-util", "defaultStatus": "unaffected"}]}], "published": "2026-08-06T15:16:41.890", "references": [{"url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/06/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as\u00a0\u00a0Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}, {"lang": "es", "value": "APR-util versiones 1.6.3 (y anteriores), la funci\u00f3n apr_password_validate() no era de tiempo constante con respecto a las comparaciones de hashes o contrase\u00f1as, potencialmente filtrando su contenido a trav\u00e9s de un ataque de temporizaci\u00f3n de canal lateral, particularmente en plataformas sin crypt() como Windows, BeOS, NetWare o Android.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.6.4, que corrige este problema."}], "lastModified": "2026-09-29T14:10:00.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BB400D3-9995-461D-9DCD-EBB95F8D6377", "versionEndExcluding": "1.6.4", "versionStartIncluding": "1.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}