🟠 High | Source: Microsoft Security Response Center
CVE-2025-49506 is a timing attack vulnerability in the Apache Portable Runtime Utility (APR-util) library, specifically in the apr_password_validate() function used to verify passwords. By measuring how long the function takes to respond, an attacker could potentially deduce valid passwords or credentials without direct access. This matters because APR-util is widely embedded in many server-side applications and services, including those running on Azure.
Security Architect’s Take: Identify any Azure-hosted workloads or services relying on Apache APR-util and prioritise patching to the remediated version as soon as it is available; additionally, review whether network-level controls or rate limiting can reduce an attacker’s ability to conduct timing measurements against exposed authentication endpoints.
Original advisory: CVE-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack