CVE-2025-49506
HighAdvisory
Published 6 Aug 2026In the index since 6 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.004
- 31st percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 155
- of 17,781 indexed, latest versions
- Container images
- 159
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack
Carried by container images the latest versions of 155 of 17,781 indexed charts deploy, on 159 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| apr-utildeb | 1.6.1-4ubuntu2, 1.6.1-4ubuntu2.2, 1.6.1-5ubuntu4.22.04.2, 1.6.3-1+2 more | 1.6.1-4ubuntu2.2+esm1, 1.6.1-5ubuntu4.22.04.3, 1.6.3-1.1ubuntu7.1, 1.6.3-1+deb12u1+1 more | 149 |
| apr-utilapk | 1.6.3-r1, 1.6.3-r2 | 1.6.4-r0 | 8 |
| apr-utilbitnami | 1.6.3 | 1.6.4 | 2 |
- OSV records
- ALPINE-CVE-2025-49506BIT-apr-util-2025-49506DEBIAN-CVE-2025-49506UBUNTU-CVE-2025-49506
- Also known as
- USN-8719-1
Charts affected
155 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| owncloudth-chartsVerified publisher | 0.2.1 | 1 of 1See more | 10,006 |
| tfy-distributortruefoundryVerified publisher | 0.0.1 | 1 of 4See more | 17,323 |
| demo-backendv2flyVerified publisher | 0.0.3 | 1 of 1See more | 14,358 |
| web-dvwaweb-dvwa | 1.16.0 | 1 of 2See more | 10,001 |
| zoo-project-druzoo-projectOfficialVerified publisher | 0.10.4 | 1 of 6See more | 7,849 |
Container images carrying it
159 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 95d6f0e05636 | apr-util | 1.6.3-1+deb12u1 | 6 |
| library/ | 1b766f17b840 | apr-util | 1.6.4-r0 | 4 |
| quay.io/ | 709c7da19c5a | apr-util | 1.6.3-1+deb12u1 | 3 |
| cfssl/ | c9018c2ddf0b | apr-util | 1.6.3-1+deb12u1 | 2 |
| gjeanmart/ | 926264c8f2d1 | apr-util | 1.6.3-1+deb12u1 | 2 |
| library/ | 6e75aa8f767c | apr-util | 1.6.3-1+deb12u1 | 2 |
| library/ | eedf63967cdb | apr-util | 1.6.3-1+deb12u1 | 2 |
| library/ | 30bff39330d1 | apr-util | 1.6.3-3+deb13u1 | 2 |
| moreillon/ | e1c9bfab5c16 | apr-util | 1.6.3-1+deb12u1 | 2 |
| qichenxu4pd/ | f3a8502bc21b | apr-util | 1.6.3-1+deb12u1 | 2 |
| uffizzi/ | 0344805f267b | apr-util | 1.6.3-1+deb12u1 | 2 |
| vdiogov/ | 6945f84f0058 | apr-util | 1.6.3-1+deb12u1 | 2 |
| ghcr.io/ | cd264d33efd4 | apr-util | 1.6.3-1+deb12u1 | 2 |
| aboogie/ | 9c41a4483ac8 | apr-util | 1.6.3-1+deb12u1 | 1 |
| akaunting/ | 52811b36ec3a | apr-util | 1.6.3-1+deb12u1 | 1 |
| artur9010/ | 6b4de3ce8b0e | apr-util | 1.6.3-1+deb12u1 | 1 |
| assistiot/ | b1dbe4d62a03 | apr-util | 1.6.3-1+deb12u1 | 1 |
| avinash263/ | aa2b8727f1a6 | apr-util | 1.6.3-1+deb12u1 | 1 |
| beanbag/ | 6b840f546e1c | apr-util | 1.6.1-5ubuntu4.22.04.3 | 1 |
| beyzkaya/ | 12a6a3d1c5f9 | apr-util | 1.6.3-1+deb12u1 | 1 |
| bitnamilegacy/ | f02c000c54b1 | apr-util | 1.6.4 | 1 |
| bloxstaking/ | bf6d7d2fdc93 | apr-util | 1.6.3-1+deb12u1 | 1 |
| bnjbvr/ | 37e216b182c8 | apr-util | 1.6.3-1+deb12u1 | 1 |
| carlosmz87/ | 8ffa63aa995d | apr-util | 1.6.3-1+deb12u1 | 1 |
| checkmk/ | c11b422210c4 | apr-util | 1.6.1-5ubuntu4.22.04.3 | 1 |
| chiefonboarding/ | 59bc7aa60fe7 | apr-util | 1.6.3-3+deb13u1 | 1 |
| cloudtooling/ | f4f04e0fc401 | apr-util | 1.6.4 | 1 |
| dgraziotin/ | 38f2de42bed0 | apr-util | 1.6.1-4ubuntu2.2+esm1 | 1 |
| dokuwiki/ | f08ecfdda239 | apr-util | 1.6.3-3+deb13u1 | 1 |
| dolibarr/ | 7ad88fc9b13c | apr-util | 1.6.3-1+deb12u1 | 1 |
| domainmod/ | 4017bfe4c597 | apr-util | 1.6.3-1+deb12u1 | 1 |
| dragonflyoss/ | edf3e921f4e0 | apr-util | 1.6.3-1+deb12u1 | 1 |
| eclipseaerios/ | e7f5ba0bc64d | apr-util | 1.6.3-3+deb13u1 | 1 |
| electriccoinco/ | 2ae3a551e111 | apr-util | 1.6.3-3+deb13u1 | 1 |
| espocrm/ | 1b5a24504ed9 | apr-util | 1.6.3-3+deb13u1 | 1 |
| fiware/ | d551a13e8278 | apr-util | 1.6.3-1+deb12u1 | 1 |
| gomods/ | 0f61d1e62359 | apr-util | 1.6.4-r0 | 1 |
| gomods/ | 97cc113b34b0 | apr-util | 1.6.4-r0 | 1 |
| gulacedia/ | 67b467d961ca | apr-util | 1.6.3-1+deb12u1 | 1 |
| haveagitgat/ | 1e3f9328327d | apr-util | 1.6.1-4ubuntu2.2+esm1 | 1 |
| helicone/ | 4a913936c97b | apr-util | 1.6.3-1+deb12u1 | 1 |
| ildarmukhametzyanov/ | 15d23720a3ee | apr-util | 1.6.3-1+deb12u1 | 1 |
| instill/ | c4a393e601ed | apr-util | 1.6.3-3+deb13u1 | 1 |
| instill/ | ebe12f77a3f9 | apr-util | 1.6.3-3+deb13u1 | 1 |
| instill/ | e980125e5ba5 | apr-util | 1.6.3-3+deb13u1 | 1 |
| intelowlproject/ | 0b22e547ea6b | apr-util | 1.6.3-1+deb12u1 | 1 |
| jhoncytech/ | 18c3ca1f411e | apr-util | 1.6.3-1+deb12u1 | 1 |
| jordan/ | f75025fe8ea8 | apr-util | 1.6.3-1+deb12u1 | 1 |
| kfirfer/ | 2efb4a5d74a3 | apr-util | 1.6.1-4ubuntu2.2+esm1 | 1 |
| kimai/ | 6dfc63199654 | apr-util | 1.6.3-1+deb12u1 | 1 |