APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apr-util | Aug 10, 2026 | Aug 6, 2026 |
| Amazon_linux_2023 | — | Upgrade apr-utilUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-debuginfoUpgrade apr-util-pgsqlUpgrade apr-util-mysqlUpgrade apr-util-sqliteUpgrade apr-util-odbc-debuginfoUpgrade apr-util-debugsourceUpgrade apr-util-ldapUpgrade apr-util-develUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-opensslUpgrade apr-util-openssl-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-lmdbUpgrade apr-util-odbcUpgrade apr-util-ldap-debuginfoUpgrade apr-util-mysql-debuginfo | Sep 1, 2026 | Aug 6, 2026 |
| Debian | — | Upgrade apr-util | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | No solution existsUpgrade apr-utilUpgrade apr-util-mysql-debuginfoUpgrade apr-util-debuginfoUpgrade apr-util-mysqlUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-sqliteUpgrade apr-util-debugsourceUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-opensslUpgrade apr-util-odbcUpgrade apr-util-ldap-debuginfoUpgrade apr-util-bdbUpgrade apr-util-odbc-debuginfoUpgrade apr-util-openssl-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-ldapUpgrade apr-util-pgsqlUpgrade apr-util-lmdbUpgrade apr-util-bdb-debuginfoUpgrade apr-util-devel | Aug 13, 2026 | Aug 6, 2026 |
| Rocky_linux | — | Upgrade apr-util-opensslUpgrade apr-util-sqliteUpgrade apr-util-mysql-debuginfoUpgrade apr-utilUpgrade apr-util-debuginfoUpgrade apr-util-odbcUpgrade apr-util-bdb-debuginfoUpgrade apr-util-odbc-debuginfoUpgrade apr-util-ldapUpgrade apr-util-lmdbUpgrade apr-util-pgsqlUpgrade apr-util-bdbUpgrade apr-util-openssl-debuginfoUpgrade apr-util-ldap-debuginfoUpgrade apr-util-debugsourceUpgrade apr-util-develUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-mysql | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade libaprutil1Upgrade libaprutil1t64Upgrade libaprutil1 (Ubuntu Pro) | Sep 14, 2026 | Sep 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub