Threats affecting pkg:maven/org.apache.apr/apr-util

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.

CVE-2025-49506 is a timing side-channel vulnerability in the Apache Portable Runtime Utility (APR-util) affecting versions up to and including 1.6.3. The apr_password_validate() function did not perform password or hash comparisons in constant time, potentially allowing attackers to infer sensitive information via timing discrepancies on platforms lacking the crypt() function, such as Windows, BeOS, NetWare, or Android. The issue is fixed in version 1.6.4.

A heap-based buffer overflow vulnerability exists in the Apache Portable Runtime Utility memcached client affecting versions from 1.3.0 through 1.6.3. This vulnerability can cause a denial of service due to application crashes. The issue is classified under CWE-122 and has a CVSS v3.1 base score of 7.5, indicating high severity. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.