CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

EUVD-2025-210642

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2025-49506

The APR-util library (versions 1.6.3 and earlier) contains a vulnerability in the apr_password_validate() function. The function does not perform password or hash comparisons in constant-time , which can lead to information disclosure via a side-channel timing attack . This risk is specifically n...

CVE-2025-49506

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

CVE-2026-16731

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16315

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

Security Bulletin: Due to the use of Bouncy Castle Inc. BC-JAVA bcprov IBM webMethods Managed File Transfer is vulnerable to a Covert Timing Channel vulnerability and Use of a Broken or Risky Cryptographic Algorithm vulnerability

Summary Bouncy Castle Inc. BC-JAVA bcprov is used by IBM webMethods Managed File Transfer CVE-2025-14813, CVE-2026-5598, CVE-2026-0636 Vulnerability Details CVEID:CVE-2025-14813 DESCRIPTION: : Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc. BC-JA...

EUVD-2026-53923

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16731

The CVE-2026-16731 entry affects OMICRON StationScout prior to version 3.05, where a cryptographic timing side-channel in the backend authentication enables an unauthenticated attacker to forge valid credentials and bypass authentication/authorization, effectively impersonating legitimate clients...

CVE-2026-16731 Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16731 Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

EUVD-2026-53921

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16315

CVE-2026-16315 affects OMICRON StationGuard prior to 4.10. The issue is a cryptographic timing side-channel in the backend authentication mechanism, allowing an unauthenticated attacker to forge valid credentials, bypass authentication/authorization, and impersonate legitimate clients. This can g...

CVE-2026-16315 Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2026-16315 Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

CVE-2025-49506: Observable Timing Discrepancy

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

PT-2026-68490

Name of the Vulnerable Software and Affected Versions OMICRON StationGuard versions prior to 4.10 Description A cryptographic timing side-channel vulnerability exists in the backend authentication mechanism. This flaw allows an unauthenticated attacker to forge valid authentication credentials,...

EulerOS 2.0 SP15 : gnutls (EulerOS-SA-2026-2925)

According to the versions of the gnutls packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of nameConstraints labels, specifically f...

CVE-2026-16731: Observable Timing Discrepancy

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...