CVE-2025-49506

High

Advisory

Published 6 Aug 2026In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.004; 31st percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 155; of 17,781 indexed, latest versions
Container images: 159; deployed by those charts
Fix available: 3 of 3; affected packages

Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

Carried by container images the latest versions of 155 of 17,781 indexed charts deploy, on 159 images.

Affected package	Affected versions	Fixed in	Images
apr-utildeb	1.6.1-4ubuntu2, 1.6.1-4ubuntu2.2, 1.6.1-5ubuntu4.22.04.2, 1.6.3-1+2 more	1.6.1-4ubuntu2.2+esm1, 1.6.1-5ubuntu4.22.04.3, 1.6.3-1.1ubuntu7.1, 1.6.3-1+deb12u1+1 more	149
apr-utilapk	1.6.3-r1, 1.6.3-r2	1.6.4-r0	8
apr-utilbitnami	1.6.3	1.6.4	2

OSV records: ALPINE-CVE-2025-49506 BIT-apr-util-2025-49506 DEBIAN-CVE-2025-49506 UBUNTU-CVE-2025-49506
Also known as: USN-8719-1

Charts affected

155 by stars

Chart

Latest

Affected images

Radar Score

owncloudth-charts

0.2.1

1 of 1 See more

owncloud th-charts 0.2.1

1 of the 1 container images this version deploys carry CVE-2025-49506.

Container image	Digest	Package	Fixed in
owncloud/server :10.15.0	51d9b74fc2a8	apr-util@1.6.1-4ubuntu2.2	1.6.1-4ubuntu2.2+esm1

Open the chart page →

10,006

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2025-49506.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

17,323

demo-backendv2fly

0.0.3

1 of 1 See more

demo-backend v2fly 0.0.3

1 of the 1 container images this version deploys carry CVE-2025-49506.

Container image	Digest	Package	Fixed in
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

14,358

web-dvwaweb-dvwa

1.16.0

1 of 2 See more

web-dvwa web-dvwa 1.16.0

1 of the 2 container images this version deploys carry CVE-2025-49506.

Container image	Digest	Package	Fixed in
gulacedia/web-dvwa-new :v3	67b467d961ca	apr-util@1.6.3-1	1.6.3-1+deb12u1

Open the chart page →

10,001

zoo-project-druzoo-project

0.10.4

1 of 6 See more

zoo-project-dru zoo-project 0.10.4

1 of the 6 container images this version deploys carry CVE-2025-49506.

Container image	Digest	Package	Fixed in
zooproject/zoo-project :dru-19f3c4eed7c9ec9d1f0375bbe59f9d204a42bd3a	9a507cb7e2dd	apr-util@1.6.1-5ubuntu4.22.04.2	1.6.1-5ubuntu4.22.04.3

Open the chart page →

7,849

Container images carrying it

159 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/zoriya/kyoo_scanner :4.7.1	7dc0ee57b628	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/jtekt-corporation/shinsei-manager :v2.8.1	5cd62142d6ed	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/jtekt-corporation/time-series-storage-service :v1.5.1	046ef5c9ed50	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
public.ecr.aws/supportpal/helpdesk-monolithic :4.0.4	573779e57fae	apr-util@1.6.1-4ubuntu2	1.6.1-4ubuntu2.2+esm1	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
quay.io/yushiwho/api :e1f9d77	e0d9b93dbf2b	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	apr-util@1.6.3-1	1.6.3-1+deb12u1	1
registry.gitlab.com/school_guy/docker-typo3 :13.4.30-197d868e	d76185d7270d	apr-util@1.6.3-1	1.6.3-1+deb12u1	1