Every CVE Search/ Get API key

CVE-2025-49506

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

7.5 HighFix available

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.38%Up 0.1 points since Aug 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
EUVDEUVD-2025-210642 7.5

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
EUVD-2025-210642
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-73wm-47mq-62r5 7.5

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with...

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
GHSA-73wm-47mq-62r5
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
NVD 7.5

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
OSVALPINE-CVE-2025-49506 7.5

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
ALPINE-CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBELL-CVE-2025-49506 7.5
Record
BELL-CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 32 moreShow less
OSV 7.5

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-208
Updated
2026-11-02
OSVDEBIAN-CVE-2025-49506 7.5

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
DEBIAN-CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVOESA-2026-3325 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3325
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3326 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3326
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3327 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3327
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3328 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3328
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-3409 9.1

apr-util security update

The mission of the Apache Portable Runtime (APR) project is to create and maintain software libraries that provide a predictable and consistent interface to underlying platform-specific implementations. The primary goal is to provide an API to which software developers may code and be assured of predictable if not identical behaviour regardless of the platform on which their software is built, relieving them of the need to code special-case conditions to work around or take advantage of platform-specific deficiencies or features.

Security Fix(es):

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2025-49506)

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.(CVE-2026-32327)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3(CVE-2026-34191)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.

This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.

Users are recommended to upgrade to version 1.6.4, which fixes the issue.(CVE-2026-34501)

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client

This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.(CVE-2026-34502)

Record
OESA-2026-3409
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:58474 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:58474
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:66341 7.5

Red Hat Security Advisory: apr-util security update

Record
RHSA-2026:66341
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:66392 7.5

Red Hat Security Advisory: apr-util security update

Record
RHSA-2026:66392
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:69113 7.5

Red Hat Security Advisory: apr-util security update

Record
RHSA-2026:69113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:66341 7.5

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)

  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66341
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:66392 7.5

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)

  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:66392
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:69113 7.5

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)

  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)

  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:69113
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-49506 7.5

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
UBUNTU-CVE-2025-49506
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVALSA-2026:66341 No score

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66341
Updated
2026-11-02
OSVALSA-2026:66392 No score

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:66392
Updated
2026-11-02
OSVALSA-2026:69113 No score

Moderate: apr-util security update

The mission of the Apache Portable Runtime (APR) is to provide a free library of C data structures and routines. This library contains additional utility interfaces for APR; including support for XML, LDAP, database interfaces, URI parsing and more.

Security Fix(es):

  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in redis client (CVE-2026-34501)
  • apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation (CVE-2025-49506)
  • apr-util: Apache Portable Runtime Utility: Denial of Service via XML stack recursion attack (CVE-2026-32327)
  • apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client (CVE-2026-34502)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:69113
Updated
2026-11-02
OSVAZL-94628 No score

CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
AZL-94628
Updated
2026-11-02
OSVBIT-apr-util-2025-49506 No score

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue.

Record
BIT-apr-util-2025-49506
Updated
2026-11-02
OSVCLSA-2026-1786553851 No score

apr-util: Fix of 4 CVEs

  • CVE-2025-49506: non-constant-time password and hash comparisons in apr_password_validate() leak information through a timing side channel
Record
CLSA-2026-1786553851
Updated
2026-11-02
OSVCLSA-2026-1786623875 No score

apr-util: Fix of CVE-2025-49506

  • Fix CVE-2025-49506 - non-constant-time password/hash comparison in apr_password_validate()
Record
CLSA-2026-1786623875
Updated
2026-11-02
OSVMGASA-2026-0364 No score

Updated apr-util packages fix security vulnerabilities

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack. (CVE-2025-49506) Apache Portable Runtime Utility: apr-util XML stack recursion crash. (CVE-2026-32327) Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle. (CVE-2026-34191) Apache Portable Runtime Utility: Heap buffer overflow in APR redis client. (CVE-2026-34501) Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client. (CVE-2026-34502)

Record
MGASA-2026-0364
Updated
2026-11-02
OSVopenSUSE-SU-2026:21672-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2025-49506: hash/password content leak via side channel timing attack against apr_password_validate() (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
openSUSE-SU-2026:21672-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2025-49506 No score

CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2025-49506
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2025-49506 No score

CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2025-49506
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2025-49506 No score

CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2025-49506
Updated
2026-11-02
OSVSUSE-SU-2026:23551-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2025-49506: hash/password content leak via side channel timing attack against apr_password_validate() (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:23551-1
Updated
2026-11-02
OSVSUSE-SU-2026:3905-1 No score

Security update for libapr-util1

This update for libapr-util1 fixes the following issues:

  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3905-1
Updated
2026-11-02
OSVSUSE-SU-2026:3937-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3937-1
Updated
2026-11-02
OSVSUSE-SU-2026:3938-1 No score

Security update for apr-util

This update for apr-util fixes the following issues:

  • CVE-2022-25147: buffer overflow possible with specially crafted input (bsc#1207866).
  • CVE-2025-49506: leaking content via side channel timing attack (bsc#1274237).
  • CVE-2026-32327: XML stack recursion crash (bsc#1274235).
  • CVE-2026-34191: SQL Injection via apr_dbd_oracle (bsc#1274850).
  • CVE-2026-34501: heap buffer overflow in redis client (bsc#1274852).
  • CVE-2026-34502: heap buffer overflow in APR memcached client (bsc#1274854).
Record
SUSE-SU-2026:3938-1
Updated
2026-11-02
OSVUSN-8719-1 No score

apr-util vulnerabilities

It was discovered that APR-util incorrectly performed password hash comparisons in a way that was not constant-time. An attacker could possibly use this issue to obtain sensitive information. (CVE-2025-49506)

It was discovered that APR-util incorrectly handled recursive XML element quoting. An attacker could possibly use this issue to cause applications using APR-util to crash, resulting in a denial of service. (CVE-2026-32327)

It was discovered that the APR-util Redis client incorrectly handled certain network data, resulting in a heap-based buffer overflow. A remote attacker could possibly use this issue to cause APR-util applications to crash or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-34501)

It was discovered that the APR-util memcached client incorrectly handled certain network data, resulting in a heap-based buffer overflow. A remote attacker could possibly use this issue to cause APR-util applications to crash or execute arbitrary code. (CVE-2026-34502)

Record
USN-8719-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apr-util
Alpine:v3.21
 1.2.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.22
 1.2.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.23
 1.2.0 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpine:v3.24
 1.2.0 up to 1.6.4-r0
1.6.4-r0
apr-util
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-bdb
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-devel
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-ldap
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-mysql
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-odbc
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
Show 144 moreShow less
Affected packages
PackageAffectedFixed
apr-util-openssl
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-pgsql
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util-sqlite
AlmaLinux:9
 before 1.6.1-23.el9_8.1
1.6.1-23.el9_8.1
apr-util
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-devel
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-ldap
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-lmdb
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-mysql
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-odbc
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-openssl
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-pgsql
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util-sqlite
AlmaLinux:10
 before 1.6.3-23.el10_2.1
1.6.3-23.el10_2.1
apr-util
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-bdb
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-devel
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-ldap
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-mysql
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-odbc
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-openssl
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-pgsql
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util-sqlite
AlmaLinux:8
 before 1.6.1-9.el8_10.1
1.6.1-9.el8_10.1
apr-util
Azure Linux:3
 before 1.6.3-3
1.6.3-3
apr-util
Alpaquita:23
 1.6.1-r13 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:25
 1.6.3-r2 up to 1.6.4-r0
1.6.4-r0
apr-util
Alpaquita:stream
 1.6.1-r13 up to 1.6.4-r0
1.6.4-r0
apr-util
Bitnami
 1.2.0 up to 1.6.4
1.6.4
apr-util
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-bdb
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-devel
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-ldap
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-mysql
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-odbc
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-openssl
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-pgsql
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util-sqlite
TuxCare:AlmaLinux:9.2
 before 1.6.1-20.el9_2.1.tuxcare.els2
1.6.1-20.el9_2.1.tuxcare.els2
apr-util
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-bdb
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-devel
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-ldap
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-mysql
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-odbc
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-openssl
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-pgsql
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util-sqlite
TuxCare:AlmaLinux:9.6
 before 1.6.1-23.el9.tuxcare.els2
1.6.1-23.el9.tuxcare.els2
apr-util
Debian:12
 before 1.6.3-1+deb12u1, plus listed versions
1.6.3-1
1.6.3-1+deb12u1
apr-util
Debian:13
 before 1.6.3-3+deb13u1, plus listed versions
1.6.3-3
1.6.3-3+deb13u1
apr-util
Debian:14
 before 1.6.4-1, plus listed versions
1.6.3-31.6.3-4
1.6.4-1
apr-util
Mageia:10
 before 1.6.3-3.1.mga10
1.6.3-3.1.mga10
apr-util
Mageia:9
 before 1.6.3-1.1.mga9
1.6.3-1.1.mga9
apr-util
openEuler:20.03-LTS-SP4
 before 1.6.1-16.oe2003sp4
1.6.1-16.oe2003sp4
apr-util
openEuler:22.03-LTS-SP4
 before 1.6.1-16.oe2203sp4
1.6.1-16.oe2203sp4
apr-util
openEuler:24.03-LTS-SP1
 before 1.6.4-1.oe2403sp1
1.6.4-1.oe2403sp1
apr-util
openEuler:24.03-LTS-SP3
 before 1.6.4-1.oe2403sp3
1.6.4-1.oe2403sp3
apr-util
openEuler:24.03-LTS-SP4
 before 1.6.5-1.oe2403sp4
1.6.5-1.oe2403sp4
apr-util
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-devel
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-ldap
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-lmdb
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-mysql
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-odbc
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-openssl
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-pgsql
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util-sqlite
Red Hat:hummingbird:1
 before 0:1.6.5-1.hum1
0:1.6.5-1.hum1
apr-util
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-bdb
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-bdb-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-devel
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-ldap
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-ldap-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-mysql
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-mysql-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-odbc
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-odbc-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-openssl
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-openssl-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-pgsql
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-pgsql-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-sqlite
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util-sqlite-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-debugsource
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-devel
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-ldap
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-ldap-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-lmdb
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-lmdb-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-mysql
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-mysql-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-odbc
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-odbc-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-openssl
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-openssl-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-pgsql
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-pgsql-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-sqlite
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util-sqlite-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-bdb
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-bdb-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-ldap
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-ldap-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-mysql
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-mysql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-odbc
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-odbc-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-openssl
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-openssl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-pgsql
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-pgsql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-sqlite
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util-sqlite-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util
Rocky Linux:9
 before 0:1.6.1-23.el9_8.1
0:1.6.1-23.el9_8.1
apr-util
Rocky Linux:10
 before 0:1.6.3-23.el10_2.1
0:1.6.3-23.el10_2.1
apr-util
Rocky Linux:8
 before 0:1.6.1-9.el8_10.1
0:1.6.1-9.el8_10.1
apr-util
SUSE:Linux Enterprise Server 16.0
 before 1.6.3-160000.3.1
1.6.3-160000.3.1
apr-util
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.6.3-160000.3.1
1.6.3-160000.3.1
libapr-util1
SUSE:Linux Enterprise Server 12 SP5-LTSS
 before 1.5.3-8.22.1
1.5.3-8.22.1
libapr-util1
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.5.3-8.22.1
1.5.3-8.22.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server 15 SP4-LTSS
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server 15 SP5-LTSS
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
 before 1.6.1-150300.18.8.1
1.6.1-150300.18.8.1
apr-util
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Server 15 SP6-LTSS
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
 before 1.6.1-150600.27.3.1
1.6.1-150600.27.3.1
apr-util
Ubuntu:Pro:14.04:LTS
 before 1.5.3-1ubuntu0.1~esm3, plus listed versions
1.5.2-11.5.2-1build11.5.2-2ubuntu11.5.3-11.5.3-1ubuntu0.1~esm11.5.3-1ubuntu0.1~esm2
1.5.3-1ubuntu0.1~esm3
apr-util
Ubuntu:Pro:18.04:LTS
 before 1.6.1-2ubuntu0.1+esm1, plus listed versions
1.6.0-21.6.1-11.6.1-1ubuntu21.6.1-21.6.1-2ubuntu0.1
1.6.1-2ubuntu0.1+esm1
apr-util
Ubuntu:Pro:20.04:LTS
 before 1.6.1-4ubuntu2.2+esm1, plus listed versions
1.6.1-4build11.6.1-4ubuntu11.6.1-4ubuntu21.6.1-4ubuntu2.11.6.1-4ubuntu2.2
1.6.1-4ubuntu2.2+esm1
apr-util
Ubuntu:22.04:LTS
 before 1.6.1-5ubuntu4.22.04.3, plus listed versions
1.6.1-5ubuntu21.6.1-5ubuntu31.6.1-5ubuntu41.6.1-5ubuntu4.22.04.11.6.1-5ubuntu4.22.04.2
1.6.1-5ubuntu4.22.04.3
apr-util
Ubuntu:24.04:LTS
 before 1.6.3-1.1ubuntu7.1, plus listed versions
1.6.3-1ubuntu11.6.3-1.1ubuntu51.6.3-1.1ubuntu61.6.3-1.1ubuntu7
1.6.3-1.1ubuntu7.1
apr-util
Ubuntu:26.04:LTS
 before 1.6.3-3ubuntu3.1, plus listed versions
1.6.3-3ubuntu21.6.3-3ubuntu3
1.6.3-3ubuntu3.1
apr-util
Ubuntu:Pro:16.04:LTS
 before 1.5.4-1ubuntu0.1~esm1, plus listed versions
1.5.4-11.5.4-1build1
1.5.4-1ubuntu0.1~esm1
apr-util
openSUSE:Leap 16.0
 before 1.6.3-160000.3.1
1.6.3-160000.3.1

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-49506 is a high vulnerability (CVSS 7.5) in Apache Apr-util, published August 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in apr-util 1.6.4-r0.

References

Show 73 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open