Threats tagged 'ghsa-73wm-47mq-62r5'

CVE-2025-49506 is a timing side-channel vulnerability in the Apache Portable Runtime Utility (APR-util) affecting versions up to and including 1.6.3. The apr_password_validate() function did not perform password or hash comparisons in constant time, potentially allowing attackers to infer sensitive information via timing discrepancies on platforms lacking the crypt() function, such as Windows, BeOS, NetWare, or Android. The issue is fixed in version 1.6.4.