CVE-2025-49506: APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via

highCVSS 7.5CVE-2025-49506

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 7.5
Published: 2026-08-06
Last updated: 2026-08-06
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-49506

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2025-49506	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] Apache Portable Runtime (APR): Multiple vulnerabilitiescert-bund

Recent advisories for APR-util

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

criticalCVE-2026-32327: A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any libr…nvd · 2026-08-06

CVE-2025-49506: APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via

Details

Referenced CVEs

Same CVEs, other sources

Recent advisories for APR-util

More from NVD Recent CVEs