{"schema_version": "1.6.1", "id": "CVE-2025-49506", "summary": "apr_password_validate() vulnerable to timing attack", "details": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue.", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "1.2.0"}, {"last_affected": "1.2.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5"}]}