CVE-2026-47783

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed	Patch
https://github.com/memcached/memcached/compare/1.6.41...1.6.42	Release Notes
https://github.com/memcached/memcached/wiki/ReleaseNotes1642	Release Notes
https://access.redhat.com/errata/RHSA-2026:27842
https://access.redhat.com/errata/RHSA-2026:27862
https://access.redhat.com/security/cve/CVE-2026-47783
https://bugzilla.redhat.com/show_bug.cgi?id=2480089
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47783.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-20 07:16

Updated : 2026-08-17 12:18

NVD link : CVE-2026-47783

Mitre link : CVE-2026-47783

CVE.ORG link : CVE-2026-47783

JSON object : View

Products Affected

memcached

memcached

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-47783", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47783", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-20T12:49:50.253452Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "memcached", "product": "memcached", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.42", "versionType": "semver"}], "defaultStatus": "unaffected"}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:1.6.23-7.el10_2.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "memcached", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:1.6.9-7.el9_8.1", "lessThan": "*", "versionType": "rpm"}], "packageName": "memcached", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "memcached", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "memcached", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "memcached", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-05-20T07:16:15.533", "references": [{"url": "https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/memcached/memcached/compare/1.6.41...1.6.42", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1642", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://access.redhat.com/errata/RHSA-2026:27842", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/errata/RHSA-2026:27862", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://access.redhat.com/security/cve/CVE-2026-47783", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480089", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-47783.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-208"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass."}, {"lang": "es", "value": "En memcached anterior a 1.6.42, los datos de nombre de usuario para la autenticaci\u00f3n de base de datos de contrase\u00f1as SASL tienen un canal lateral de temporizaci\u00f3n porque un bucle sale tan pronto como se encuentra un nombre de usuario v\u00e1lido por sasl_server_userdb_checkpass."}], "lastModified": "2026-08-17T12:18:48.277", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EA02C48-8B8D-4F73-9DA2-33B1535B1AF2", "versionEndExcluding": "1.6.42"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}