CVE-2026-47783

Published May 20, 2026

Last updated 14 days ago

CVSS high 8.1

sca

Memcached

SASL

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-47783 describes a timing side-channel vulnerability found in memcached versions prior to 1.6.42. This flaw specifically impacts the Simple Authentication and Security Layer (SASL) password database authentication mechanism. The vulnerability arises because the `sasl_server_userdb_checkpass` function, responsible for checking usernames during authentication, exits its internal loop as soon as a valid username is identified. This premature exit creates a measurable difference in response times between valid and invalid usernames. Attackers can exploit these timing discrepancies to remotely enumerate existing usernames on the system.

Description: In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
Source: cve@mitre.org
NVD status: Modified
Products: memcached

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.1
Impact score: 5.9
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

cve@mitre.org: CWE-208
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-208

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "4EA02C48-8B8D-4F73-9DA2-33B1535B1AF2",
            "versionEndExcluding": "1.6.42",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.