CVE-2025-49506

CVE-2025-49506 affects APR-util 1.6.3 and earlier: the function apr_password_validate() is not constant-time for hash/password comparisons, potentially leaking content via a side-channel timing attack on platforms without crypt() (e.g., Windows, BeOS, NetWare, Android). The issue is mitigated by ...