APR‑util function apr_password_validate() performs hash and password comparisons in a non‑constant‑time manner, causing measurable variations in execution time that correlate with the length and content of the hash or password. This timing side‑channel flaw allows an attacker to statistically infer portions of a stored hash or the plain‑text password, which can compromise authentication data. The weakness is classified as CWE‑208.

The vulnerability affects Apache Portable Runtime Utility (APR‑util) versions 1.6.3 and all earlier releases. Systems that build or link against these versions on platforms that lack the standard crypt() library—such as Windows, BeOS, NetWare, or Android—are vulnerable.

The CVSS score of 7.5 indicates a high risk, while an EPSS score is not available, leaving the exact exploitation probability uncertain. Based on the description, it is inferred that a remote attacker with network access to an application employing apr_password_validate could observe repeated validation attempts and analyze timing to recover hash components. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits to date. The risk level can be considered moderate to high for deployments relying on APR‑util without crypt() support.