Read the docs
TI-2025-31532 Aliases CVE-2025-49506GHSA-73wm-47mq-62r5

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Priority LOW 39CWE-208Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-208.

Summary

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Portable Runtime Utility1.2.0 – 1.6.3—No fix listedCNA
  • Apache Portable Runtime Utility VendorApache Affected 1.2.0 – 1.6.3 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:*1.2.0 to before 1.6.4VulnerableApache
  • cpe:2.3:a:apache:apr-util:*:*:*:*:*:*:*:* Versions 1.2.0 to before 1.6.4 Vulnerable ·Apache

Remediation

Red Hat 4 advisories

  • RHSA-2026:69113 Released 2026-09-21 · Red Hat rating Moderate
    apr-util security update
    • Red Hat Enterprise Linux AppStream (v. 8) apr-util-1.6.1-9.el8_10.1, apr-util-bdb-1.6.1-9.el8_10.1, apr-util-devel-1.6.1-9.el8_10.1 +6
  • RHSA-2026:66392 Released 2026-09-10 · Red Hat rating Moderate
    apr-util security update
    • Red Hat Enterprise Linux AppStream (v. 10) apr-util-1.6.3-23.el10_2.1, apr-util-devel-1.6.3-23.el10_2.1, apr-util-ldap-1.6.3-23.el10_2.1 +6
  • RHSA-2026:66341 Released 2026-09-10 · Red Hat rating Moderate
    apr-util security update
    • Red Hat Enterprise Linux AppStream (v. 9) apr-util-1.6.1-23.el9_8.1, apr-util-bdb-1.6.1-23.el9_8.1, apr-util-devel-1.6.1-23.el9_8.1 +6
Show 1 more Red Hat advisories
  • RHSA-2026:58474 Released 2026-08-22 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images apr-util-1.6.5-1.hum1@aarch64, apr-util-1.6.5-1.hum1@src, apr-util-1.6.5-1.hum1@x86_64 +16

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:66392
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:69113
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:66341
Red Hat Hardened ImagesFixed RHSA-2026:58474

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-49506
  2. 2026-10-03 Alias added: GHSA-73wm-47mq-62r5

References

Advisory 2

  • TI-2009-01863 The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util… CVSS 3.1HIGH 7.5
  • TI-2009-02302 Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache… CVSS 2.0HIGH 10.0
  • TI-2026-26488 Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle CVSS 3.1CRITICAL 9.1
  • TI-2026-24855 Apache Portable Runtime Utility: apr-util XML stack recursion crash CVSS 3.1CRITICAL 9.1
  • TI-2010-01567 Memory leak in the apr_brigade_split_line function in buckets/apr_brigade.c in the Apache… CVSS 2.0MEDIUM 5.0
  • TI-2009-01864 Off-by-one error in the apr_brigade_vprintf function in Apache APR-util before 1.3.5 on… CVSS 2.0MEDIUM 6.4
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences