CVE-2025-49506

Katalog CVE

CVSS 7.5 · High EPSS 0,38%

Kerentanan Observable Timing Discrepancy pada apache apr-util. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

29 September 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 30,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5 mailing list · advisory vendor
• http://www.openwall.com/lists/oss-security/2026/08/06/8 mailing list · advisory pihak ketiga