Every CVE Search/ Get API key

CVE-2026-47783

In memcached before 1.6.42, username data for SASL password database authentication has a timing...

8.1 HighFix available

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.26%Up 1.2 points since May 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
CVE-2026-47783
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-208, CWE-208
Updated
2026-11-02
EUVDEUVD-2026-31065 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
EUVD-2026-31065
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-qjpx-j6j4-8xpr 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing...

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
GHSA-qjpx-j6j4-8xpr
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-208
Updated
2026-11-02
NVD 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
CVE-2026-47783
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-208
Updated
2026-11-02
OSV 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
CVE-2026-47783
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-208
Updated
2026-11-02
OSVDEBIAN-CVE-2026-47783 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
DEBIAN-CVE-2026-47783
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 20 moreShow less
OSVOESA-2026-2539 8.1

memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security Fix(es):

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.(CVE-2026-47783)

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.(CVE-2026-47784)

Record
OESA-2026-2539
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:27842 8.1

Red Hat Security Advisory: memcached security update

Record
RHSA-2026:27842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:27862 8.1

Red Hat Security Advisory: memcached security update

Record
RHSA-2026:27862
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:63224 8.1

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:63224
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:27842 8.1

Important: memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security Fix(es):

  • memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:27842
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:27862 8.1

Important: memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security Fix(es):

  • memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:27862
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-47783 8.1

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
UBUNTU-CVE-2026-47783
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:27842 No score

Important: memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security Fix(es):

  • memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:27842
Updated
2026-11-02
OSVALSA-2026:27862 No score

Important: memcached security update

memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load.

Security Fix(es):

  • memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:27862
Updated
2026-11-02
OSVAZL-87008 No score

CVE-2026-47783 affecting package memcached for versions less than 1.6.27-5

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
AZL-87008
Updated
2026-11-05
OSVBIT-memcached-2026-47783 No score

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
BIT-memcached-2026-47783
Updated
2026-11-02
OSVCLSA-2026-1783629498 No score

memcached: Fix of CVE-2026-47783

  • CVE-2026-47783: timing side-channel in SASL userdb auth; use constant-time safe_memcmp() for username/password and drop the early break so the whole password file is always scanned.
Record
CLSA-2026-1783629498
Updated
2026-11-02
OSVCLSA-2026-1783635895 No score

memcached: Fix of CVE-2026-47783

  • CVE-2026-47783: timing side-channel in SASL userdb auth; use constant-time safe_memcmp() for username/password and drop the early break so the whole password file is always scanned.
Record
CLSA-2026-1783635895
Updated
2026-11-02
OSVMGASA-2026-0203 No score

Updated memcached packages fix security vulnerabilities

CVE-2026-47784 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass. CVE-2026-47783 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Record
MGASA-2026-0203
Updated
2026-11-02
OSVopenSUSE-SU-2026:10882-1 No score

memcached-1.6.42-1.1 on GA media

These are all security issues fixed in the memcached-1.6.42-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10882-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20884-1 No score

Security update for memcached

This update for memcached fixes the following issues

  • CVE-2026-47783: timing side-channel in SASL password database authentication (username) (bsc#1265873).
  • CVE-2026-47784: timing side-channel in SASL password database authentication (password) (bsc#1265881).
Record
openSUSE-SU-2026:20884-1
Updated
2026-11-02
OSVSUSE-SU-2026:22022-1 No score

Security update for memcached

This update for memcached fixes the following issues

  • CVE-2026-47783: timing side-channel in SASL password database authentication (username) (bsc#1265873).
  • CVE-2026-47784: timing side-channel in SASL password database authentication (password) (bsc#1265881).
Record
SUSE-SU-2026:22022-1
Updated
2026-11-02
OSVSUSE-SU-2026:2292-1 No score

Security update for memcached

This update for memcached fixes the following issues

  • CVE-2026-47783: timing side-channel in SASL password database authentication (username) (bsc#1265873).
  • CVE-2026-47784: timing side-channel in SASL password database authentication (password) (bsc#1265881).
Record
SUSE-SU-2026:2292-1
Updated
2026-11-02
OSVSUSE-SU-2026:2293-1 No score

Security update for memcached

This update for memcached fixes the following issues

  • CVE-2026-47783: timing side-channel in SASL password database authentication (username) (bsc#1265873).
  • CVE-2026-47784: timing side-channel in SASL password database authentication (password) (bsc#1265881).
Record
SUSE-SU-2026:2293-1
Updated
2026-11-02
OSVUSN-8320-1 No score

memcached vulnerabilities

It was discovered that Memcached's SASL password database authentication had a timing side channel when handling username and password data. A remote attacker could possibly use this issue to obtain sensitive information.

Record
USN-8320-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
memcached
AlmaLinux:10
 before 1.6.23-7.el10_2.1
1.6.23-7.el10_2.1
memcached-selinux
AlmaLinux:10
 before 1.6.23-7.el10_2.1
1.6.23-7.el10_2.1
memcached
AlmaLinux:9
 before 1.6.9-7.el9_8.1
1.6.9-7.el9_8.1
memcached-selinux
AlmaLinux:9
 before 1.6.9-7.el9_8.1
1.6.9-7.el9_8.1
memcached
Azure Linux:3
 before 1.6.27-5
1.6.27-5
memcached
Bitnami
 before 1.6.42
1.6.42
memcached
TuxCare:AlmaLinux:9.6
 before 1.6.9-7.el9.tuxcare.els2
1.6.9-7.el9.tuxcare.els2
memcached-devel
TuxCare:AlmaLinux:9.6
 before 1.6.9-7.el9.tuxcare.els2
1.6.9-7.el9.tuxcare.els2
memcached-selinux
TuxCare:AlmaLinux:9.6
 before 1.6.9-7.el9.tuxcare.els2
1.6.9-7.el9.tuxcare.els2
memcached
TuxCare:AlmaLinux:9.2
 before 1.6.9-7.el9.tuxcare.els2
1.6.9-7.el9.tuxcare.els2
Show 34 moreShow less
Affected packages
PackageAffectedFixed
memcached-devel
TuxCare:AlmaLinux:9.2
 before 1.6.9-7.el9.tuxcare.els2
1.6.9-7.el9.tuxcare.els2
memcached-selinux
TuxCare:AlmaLinux:9.2
 before 1.6.9-7.el9.tuxcare.els2
1.6.9-7.el9.tuxcare.els2
memcached
Debian:12
 before 1.6.18-1+deb12u1, plus listed versions
1.6.18-1
1.6.18-1+deb12u1
memcached
Debian:13
 All versions, plus listed versions
1.6.38-11.6.39-11.6.39-21.6.40-11.6.41-11.6.41-21.6.42-11.6.45-1
 None known
memcached
Debian:14
 before 1.6.42-1, plus listed versions
1.6.38-11.6.39-11.6.39-21.6.40-11.6.41-11.6.41-2
1.6.42-1
memcached
Mageia:9
From an advisory covering 2 CVEs
 before 1.6.42-1.mga9
1.6.42-1.mga9
memcached
openEuler:24.03-LTS-SP1
From an advisory covering 2 CVEs
 before 1.6.22-5.oe2403sp1
1.6.22-5.oe2403sp1
memcached
openEuler:24.03-LTS-SP3
From an advisory covering 2 CVEs
 before 1.6.22-5.oe2403sp3
1.6.22-5.oe2403sp3
memcached
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.5.10-7.oe2003sp4
1.5.10-7.oe2003sp4
memcached
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 1.6.12-5.oe2203sp4
1.6.12-5.oe2203sp4
memcached
openEuler:24.03-LTS
From an advisory covering 2 CVEs
 before 1.6.22-5.oe2403
1.6.22-5.oe2403
memcached
Red Hat:enterprise_linux:10.2
 before 0:1.6.23-7.el10_2.1
0:1.6.23-7.el10_2.1
memcached-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.6.23-7.el10_2.1
0:1.6.23-7.el10_2.1
memcached-debugsource
Red Hat:enterprise_linux:10.2
 before 0:1.6.23-7.el10_2.1
0:1.6.23-7.el10_2.1
memcached-selinux
Red Hat:enterprise_linux:10.2
 before 0:1.6.23-7.el10_2.1
0:1.6.23-7.el10_2.1
memcached
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.9-7.el9_8.1
0:1.6.9-7.el9_8.1
memcached-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.9-7.el9_8.1
0:1.6.9-7.el9_8.1
memcached-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.9-7.el9_8.1
0:1.6.9-7.el9_8.1
memcached-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:1.6.9-7.el9_8.1
0:1.6.9-7.el9_8.1
memcached
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.6.45-1.hum1
0:1.6.45-1.hum1
memcached-devel
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.6.45-1.hum1
0:1.6.45-1.hum1
memcached-selinux
Red Hat:hummingbird:1
From an advisory covering 2 CVEs
 before 0:1.6.45-1.hum1
0:1.6.45-1.hum1
memcached
Rocky Linux:10
 before 0:1.6.23-7.el10_2.1
0:1.6.23-7.el10_2.1
memcached
Rocky Linux:9
 before 0:1.6.9-7.el9_8.1
0:1.6.9-7.el9_8.1
memcached
SUSE:Linux Enterprise Server 16.0
From an advisory covering 2 CVEs
 before 1.6.38-160000.3.1
1.6.38-160000.3.1
memcached
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 2 CVEs
 before 1.6.38-160000.3.1
1.6.38-160000.3.1
memcached
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.4.24-2ubuntu11.4.25-1ubuntu21.4.25-2ubuntu11.4.25-2ubuntu1.21.4.25-2ubuntu1.31.4.25-2ubuntu1.41.4.25-2ubuntu1.51.4.25-2ubuntu1.5+esm1
 None known
memcached
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.4.33-1ubuntu31.5.4-1ubuntu21.5.4-1ubuntu31.5.6-0ubuntu11.5.6-0ubuntu1.11.5.6-0ubuntu1.21.5.6-0ubuntu1.2+esm1
 None known
memcached
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.5.10-0ubuntu31.5.10-0ubuntu41.5.19-21.5.20-11.5.22-1ubuntu1
Show 4 moreShow less
1.5.22-21.5.22-2ubuntu0.11.5.22-2ubuntu0.21.5.22-2ubuntu0.3
 None known
memcached
Ubuntu:22.04:LTS
 before 1.6.14-1ubuntu0.2, plus listed versions
1.6.9+dfsg-1build11.6.12+dfsg-2ubuntu11.6.12+dfsg-31.6.12+dfsg-41.6.13-11.6.14-11.6.14-1ubuntu0.1
1.6.14-1ubuntu0.2
memcached
Ubuntu:24.04:LTS
 before 1.6.24-1ubuntu0.1, plus listed versions
1.6.21-11.6.22-11.6.23-11.6.24-1build11.6.24-1build3
1.6.24-1ubuntu0.1
memcached
Ubuntu:25.10
 before 1.6.38-1ubuntu0.1, plus listed versions
1.6.37-11.6.38-11.6.38-1build1
1.6.38-1ubuntu0.1
memcached
Ubuntu:26.04:LTS
 before 1.6.40-1ubuntu0.1, plus listed versions
1.6.38-1build11.6.39-21.6.40-1
1.6.40-1ubuntu0.1
memcached
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.6.42-1.1
1.6.42-1.1

History

History
RecordedChangedSources
affected
factsOSV
affected, aliases
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-47783 is a high vulnerability (CVSS 8.1) in Memcached, published May 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in memcached 1.6.23-7.el10_2.1.

References

Show 47 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open