CVE-2025-49506

HighCVSS 7.5

Published: 06/08/2026(UTC)Updated: 29/09/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

29th percentile - higher than 29% of all known CVEs

Summary

The apr_password_validate() function in APR-util versions 1.6.3 and earlier did not perform constant-time comparisons of hashes or passwords, potentially leaking their content via a side-channel timing attack, especially on platforms without crypt() such as Windows, BeOS, NetWare, or Android.

Risk Assessment

An attacker could exploit timing measurements to reconstruct passwords or hashes, leading to a breach of credential confidentiality and potential account takeover.

Recommendation

It is recommended to upgrade APR-util to version 1.6.4 or later, which fixes this issue.

Other vulnerabilities in APR-util

CVE-2026-32327Critical
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Original NVD description (English source)

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS