CVE-2026-47784

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed	Patch
https://github.com/memcached/memcached/compare/1.6.41...1.6.42	Release Notes
https://github.com/memcached/memcached/wiki/ReleaseNotes1642	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-20 07:16

Updated : 2026-07-24 10:10

NVD link : CVE-2026-47784

Mitre link : CVE-2026-47784

CVE.ORG link : CVE-2026-47784

JSON object : View

Products Affected

memcached

memcached

CWE

CWE-208

Observable Timing Discrepancy

{"id": "CVE-2026-47784", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47784", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-20T12:20:56.239253Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "memcached", "product": "memcached", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.42", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-20T07:16:15.733", "references": [{"url": "https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/memcached/memcached/compare/1.6.41...1.6.42", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://github.com/memcached/memcached/wiki/ReleaseNotes1642", "tags": ["Release Notes"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-208"}]}], "descriptions": [{"lang": "en", "value": "In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass."}, {"lang": "es", "value": "En memcached antes de 1.6.42, los datos de contrase\u00f1a para la autenticaci\u00f3n de la base de datos de contrase\u00f1as SASL tienen un canal lateral de temporizaci\u00f3n porque memcmp es utilizado por sasl_server_userdb_checkpass."}], "lastModified": "2026-07-24T10:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EA02C48-8B8D-4F73-9DA2-33B1535B1AF2", "versionEndExcluding": "1.6.42"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}