CVE-2025-49506
Awaiting Analysis Awaiting Analysis - Queue

APR-util Timing Attack in Password Validation

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: Apache Software Foundation

Description
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2025-49506
EUVD
EUVD-2025-210642

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache apr_util to 1.6.4 (exc)
apache apr-util From 1.6.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects APR-util versions 1.6.3 and earlier. The function apr_password_validate() does not use constant-time comparison for hashes or passwords, which could allow timing side-channel attacks to leak sensitive information like passwords.

Detection Guidance

Detection involves checking the version of APR-util installed on your system. Run 'apu-1-config --version' or check package managers like 'rpm -qa | grep apr-util' or 'dpkg -l | grep apr-util' to verify if the version is 1.6.3 or earlier.

Impact Analysis

Attackers could exploit timing differences to guess or extract passwords, especially on platforms without crypt() like Windows, BeOS, NetWare, or Android. This risks unauthorized access to systems or data protected by these passwords.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Compliance may be compromised if passwords are exposed.

Mitigation Strategies

Upgrade APR-util to version 1.6.4 or later immediately. Use your package manager to update, e.g., 'yum update apr-util' or 'apt-get install --only-upgrade apr-util'.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-49506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart