memcached up to 1.6.41 sasl_server_userdb_checkpass timing discrepancy

Summaryinfo

A vulnerability has been found in memcached up to 1.6.41 and classified as problematic. This vulnerability affects the function sasl_server_userdb_checkpass. The manipulation leads to timing discrepancy. This vulnerability is traded as CVE-2026-47784. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in memcached up to 1.6.41 and classified as problematic. This issue affects the function sasl_server_userdb_checkpass. The manipulation with an unknown input leads to a timing discrepancy vulnerability. Using CWE to declare the problem leads to CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. Impacted is confidentiality. The summary by CVE is:

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-47784 since 05/20/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability scanner Nessus provides a plugin with the ID 315766 (Linux Distros Unpatched Vulnerability : CVE-2026-47784), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.6.42 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (315766), EUVD (EUVD-2026-31069) and CERT Bund (WID-SEC-2026-1615). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Affected

• Debian Linux
• Open Source memcached

Productinfo

Name

• memcached

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.6.6
• 1.6.7
• 1.6.8
• 1.6.9
• 1.6.10
• 1.6.11
• 1.6.12
• 1.6.13
• 1.6.14
• 1.6.15
• 1.6.16
• 1.6.17
• 1.6.18
• 1.6.19
• 1.6.20
• 1.6.21
• 1.6.22
• 1.6.23
• 1.6.24
• 1.6.25
• 1.6.26
• 1.6.27
• 1.6.28
• 1.6.29
• 1.6.30
• 1.6.31
• 1.6.32
• 1.6.33
• 1.6.34
• 1.6.35
• 1.6.36
• 1.6.37
• 1.6.38
• 1.6.39
• 1.6.40
• 1.6.41

Website

• Product: https://github.com/memcached/memcached/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion