CVE-2026-47783
High · 8.1CVSS
8.1
EPSS
1.3%
Published
May 20, 2026
CISA due date
—
The record
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | memcached | 0 | 1.6.42-1.1 |
Related vulnerabilities
- CVE-2026-47784 In memcached before 1.6.42, password data for SASL password database authentication has a… Also affects memcached
- CVE-2017-9951 The try_read_command function in memcached.c in memcached before 1.4.39 allows remote… Also affects memcached
- CVE-2016-8704 An integer overflow in the process_bin_append_prepend function in Memcached, which is… Also affects memcached
- CVE-2016-8706 An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible… Also affects memcached
- CVE-2016-8705 Multiple integer overflows in process_bin_update function in Memcached, which is… Also affects memcached
- CVE-2011-4971 Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2)… Also affects memcached
- CVE-2026-87946 Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows… CWE-208
- CVE-2026-49265 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. CWE-208