CVE-2025-49506 PUBLISHED

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Assigner: apache
Reserved: 06.06.2025 Published: 06.08.2026 Updated: 06.08.2026

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Product Status

Vendor Apache Software Foundation
Product Apache Portable Runtime Utility
Versions Default: unaffected
  • affected from 1.2.0 to 1.6.3 (incl.)

Credits

  • Michael Rowley <michael csirt.global> finder

References

Problem Types

  • CWE-208 Observable Timing Discrepancy CWE