CVE-2025-49506

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-49506", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2025-06-06T09:23:28.146Z", "datePublished": "2026-08-06T14:33:12.957Z", "dateUpdated": "2026-08-06T21:56:06.543Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "APR-util", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "1.2.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Michael Rowley <michael csirt.global>"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;Windows, BeOS, NetWare, or Android.</span></div><div>Users are recommended to upgrade to version 1.6.4, which fixes this issue.<br></div><div></div>"}], "value": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as\u00a0\u00a0Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:33:12.957Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2024-06-03T00:00:00.000Z", "value": "Reported to security team"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936805"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "title": "Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-06T17:45:19.290280Z", "id": "CVE-2025-49506", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T17:45:22.645Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:06.543Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/06/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-06T21:56:06.543Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-49506", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T17:45:19.290280Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T17:45:12.827Z"}}], "cna": {"title": "Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Michael Rowley <michael csirt.global>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Portable Runtime Utility", "versions": [{"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.6.3"}], "packageName": "APR-util", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2024-06-03T00:00:00.000Z", "value": "Reported to security team"}, {"lang": "en", "time": "2026-08-06T12:00:00.000Z", "value": "fixed in 1.6.x by r1936805"}, {"lang": "en", "time": "2026-08-06T12:58:00.000Z", "value": "1.6.4 released"}], "references": [{"url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as\u00a0\u00a0Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "<div>APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as&nbsp;<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;Windows, BeOS, NetWare, or Android.</span></div><div>Users are recommended to upgrade to version 1.6.4, which fixes this issue.<br></div><div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-208", "description": "CWE-208 Observable Timing Discrepancy"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-08-06T14:33:12.957Z"}}}, "cveMetadata": {"cveId": "CVE-2025-49506", "state": "PUBLISHED", "dateUpdated": "2026-08-06T21:56:06.543Z", "dateReserved": "2025-06-06T09:23:28.146Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-08-06T14:33:12.957Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "APR-util", "product": "Apache Portable Runtime Utility", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.6.3", "status": "affected", "version": "1.2.0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*", "matchCriteriaId": "0BB400D3-9995-461D-9DCD-EBB95F8D6377", "versionEndExcluding": "1.6.4", "versionStartIncluding": "1.2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as\u00a0\u00a0Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."}, {"lang": "es", "value": "APR-util versiones 1.6.3 (y anteriores), la funci\u00f3n apr_password_validate() no era de tiempo constante con respecto a las comparaciones de hashes o contrase\u00f1as, potencialmente filtrando su contenido a trav\u00e9s de un ataque de temporizaci\u00f3n de canal lateral, particularmente en plataformas sin crypt() como Windows, BeOS, NetWare o Android.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 1.6.4, que corrige este problema."}], "id": "CVE-2025-49506", "lastModified": "2026-09-29T14:10:00.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-49506", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-06T17:45:19.290280Z", "version": "2.0.3"}}]}, "published": "2026-08-06T15:16:41.890", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/08/06/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-208"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation", "id": "2512077", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512077"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-208", "details": ["APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as\u00a0\u00a0Windows, BeOS, NetWare, or Android.\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.", "A flaw was found in Apache Portable Runtime Utility (apr-util). The `apr_password_validate()` function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without `crypt()` such as Windows, BeOS, NetWare, or Android. By observing the time differences in comparisons, an attacker could potentially deduce the content of sensitive information like password hashes."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2025-49506", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "apr-util", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "apr-util", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-08-06T14:33:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-49506\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-49506\nhttps://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5"], "statement": "This vulnerability is assessed as Low Impact due to significant practical exploitation barriers. While the theoretical outcome of a successful timing attack is hash disclosure (Confidentiality: High), isolating microsecond-level comparison differences over a network is rendered practically infeasible by unpredictable network latency, packet jitter, and server scheduling noise (Attack Complexity: High). Additionally, RHEL environments natively rely on the system crypt() implementation for standard password checks, bypassing the vulnerable non-constant-time fallback code path in standard deployment scenarios.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.2.0,1.6.3]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Portable Runtime Utility", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "portable_runtime_utility", "vendor": "apache"}], "created": "2026-08-06T16:00:06.380297+00:00", "updated": "2026-08-06T20:00:04.818587+00:00", "vendors": ["apache", "apache$PRODUCT$portable_runtime_utility"]}