CVE-2025-49506: Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Eric Covener <[email protected]>
Newsgroups gmane.comp.apache.apr.devel
Message-ID <[email protected]> 
Severity: low 

Affected versions:

- Apache Portable Runtime Utility (APR-util) 1.2.0 through 1.6.3

Description:

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Credit:

Michael Rowley <michael csirt.global> (finder)

References:

https://apr.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-49506

Timeline:

2024-06-03: Reported to security team
2026-08-06: fixed in 1.6.x by r1936805
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.