CVE-2026-47783
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
In memcached before version 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
Risk Assessment
An attacker can exploit timing differences to enumerate valid usernames, facilitating brute-force password attacks and potentially leading to unauthorized access.
Recommendation
Update memcached to version 1.6.42 or later, which includes a fix that eliminates the timing side channel.
Other vulnerabilities in memcached
See all- CVE-2017-9951High
The try_read_command function in memcached before version 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read.
- CVE-2016-8706High
An integer overflow in the process_bin_sasl_auth function in Memcached can be exploited to cause heap overflow and lead to remote code execution.
- CVE-2016-8705Critical
Multiple integer overflows in the process_bin_update function in Memcached can be exploited to cause heap overflow and lead to remote code execution.
- CVE-2016-8704Critical
An integer overflow in the process_bin_append_prepend function in Memcached can be exploited to cause heap overflow and lead to remote code execution.
- CVE-2026-47784High
Memcached before version 1.6.42 uses the memcmp function for password comparison in SASL authentication, causing a timing side-channel vulnerability. An attacker can read passwords by measuring response times.
Original NVD description (English source)
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.