CAPTCHA disclosure via reusable timing comparison

Observable timing discrepancy in Apache Answer before 1.0.6 allows remote attackers to infer CAPTCHA values through repeated checks. VerifyCaptcha compares supplied text with the cached solution using ordinary string equality and, before the correction, leaves that solution reusable for repeated timing measurements. No authentication or user interaction is required; the bounded impact is disclosure of the CAPTCHA answer for the checked challenge.