CVE-2026-47784 Details
Description
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
A timing side-channel vulnerability has been identified in Memcached versions prior to 1.6.42, specifically within the SASL password database authentication mechanism. The issue arises because the function used to compare passwords, 'memcmp', can be exploited to infer information about the password data through timing analysis. This vulnerability allows an attacker to potentially leak password bytes by measuring the time taken for comparisons to complete.
Users are advised to upgrade to Memcached version 1.6.42 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| memcached memcached | < 1.6.42 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 21, 2026 | Initial Analysis | [email protected] |
| May 20, 2026 | New CVE Received | [email protected] |