CVE-2025-49506

Name of the Vulnerable Software and Affected Versions APR-util versions prior to 1.6.4

Description The function apr password validate() does not operate in constant-time when comparing hashes or passwords. This behavior can lead to the leakage of sensitive content through a side channel timing attack, which occurs when an attacker analyzes the time taken to execute a cryptographic operation to deduce information. This issue is especially prominent on platforms that lack the crypt() function, including Windows, BeOS, NetWare, and Android.

Recommendations Upgrade to version 1.6.4.