memcached up to 1.6.41 sasl_server_userdb_checkpass timing discrepancy

Summaryinfo

A vulnerability, which was classified as problematic, was found in memcached up to 1.6.41. This affects the function sasl_server_userdb_checkpass. Executing a manipulation can lead to timing discrepancy. This vulnerability appears as CVE-2026-47783. The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in memcached up to 1.6.41 and classified as problematic. This vulnerability affects the function sasl_server_userdb_checkpass. The manipulation with an unknown input leads to a timing discrepancy vulnerability. The CWE definition for the vulnerability is CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. As an impact it is known to affect confidentiality. CVE summarizes:

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-47783 since 05/20/2026. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability scanner Nessus provides a plugin with the ID 315754 (Linux Distros Unpatched Vulnerability : CVE-2026-47783), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.6.42 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315754), EUVD (EUVD-2026-31065) and CERT Bund (WID-SEC-2026-1615). Once again VulDB remains the best source for vulnerability data.

Affected

• Debian Linux
• Open Source memcached

Productinfo

Name

• memcached

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.6.20
• 1.6.21
• 1.6.22
• 1.6.23
• 1.6.24
• 1.6.25
• 1.6.26
• 1.6.27
• 1.6.28
• 1.6.29
• 1.6.30
• 1.6.31
• 1.6.32
• 1.6.33
• 1.6.34
• 1.6.35
• 1.6.36
• 1.6.37
• 1.6.38
• 1.6.39
• 1.6.40
• 1.6.41

Website

• Product: https://github.com/memcached/memcached/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion