APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade apr-util | Aug 10, 2026 | Aug 6, 2026 |
| Amazon_linux_2023 | — | Upgrade apr-util-sqlite-debuginfoUpgrade apr-util-mysql-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-odbcUpgrade apr-util-ldap-debuginfoUpgrade apr-util-opensslUpgrade apr-util-lmdbUpgrade apr-util-openssl-debuginfoUpgrade apr-util-mysqlUpgrade apr-util-debugsourceUpgrade apr-util-debuginfoUpgrade apr-util-pgsql-debuginfoUpgrade apr-utilUpgrade apr-util-pgsqlUpgrade apr-util-develUpgrade apr-util-sqliteUpgrade apr-util-odbc-debuginfoUpgrade apr-util-ldap | Sep 1, 2026 | Aug 6, 2026 |
| Debian | — | Upgrade apr-util | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | Upgrade apr-utilUpgrade apr-util-sqlite-debuginfoNo solution existsUpgrade apr-util-sqliteUpgrade apr-util-debugsourceUpgrade apr-util-debuginfoUpgrade apr-util-mysql-debuginfoUpgrade apr-util-mysqlUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-openssl-debuginfoUpgrade apr-util-bdb-debuginfoUpgrade apr-util-lmdbUpgrade apr-util-develUpgrade apr-util-opensslUpgrade apr-util-odbcUpgrade apr-util-ldapUpgrade apr-util-pgsqlUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-odbc-debuginfoUpgrade apr-util-bdbUpgrade apr-util-ldap-debuginfo | Aug 13, 2026 | Aug 6, 2026 |
| Rocky_linux | — | Upgrade apr-util-mysql-debuginfoUpgrade apr-utilUpgrade apr-util-debuginfoUpgrade apr-util-odbcUpgrade apr-util-sqliteUpgrade apr-util-bdb-debuginfoUpgrade apr-util-opensslUpgrade apr-util-sqlite-debuginfoUpgrade apr-util-mysqlUpgrade apr-util-ldap-debuginfoUpgrade apr-util-lmdb-debuginfoUpgrade apr-util-openssl-debuginfoUpgrade apr-util-bdbUpgrade apr-util-ldapUpgrade apr-util-odbc-debuginfoUpgrade apr-util-pgsqlUpgrade apr-util-lmdbUpgrade apr-util-pgsql-debuginfoUpgrade apr-util-debugsourceUpgrade apr-util-devel | Sep 15, 2026 | Sep 11, 2026 |
| Ubuntu | — | Upgrade libaprutil1 (Ubuntu Pro)Upgrade libaprutil1Upgrade libaprutil1t64 | Sep 14, 2026 | Sep 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub