Skip to main content

memcached EUVDEUVD-2026-31069

| CVE-2026-47784 HIGH
Observable Timing Discrepancy (CWE-208)
2026-05-20 mitre GHSA-r4h3-4q3v-2776
Information Disclosure Memcached
8.1
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
5.9 MEDIUM
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
May 20, 2026 - 07:01 EUVD
Source Code Evidence Fetched
May 20, 2026 - 07:00 vuln.today
Analysis Generated
May 20, 2026 - 07:00 vuln.today

DescriptionCVE.org

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

AnalysisAI

Timing side-channel in memcached versions prior to 1.6.42 allows remote attackers to recover SASL authentication credentials by measuring response times during password comparison. The flaw stems from the use of the non-constant-time memcmp() function within sasl_server_userdb_checkpass, enabling byte-by-byte inference of stored passwords. No public exploit identified at time of analysis, but the upstream fix has been published.

Technical ContextAI

memcached is a widely deployed in-memory key-value store used as a caching layer for web applications and databases. When configured with SASL authentication backed by a userdb password file (sasl_defs.c), the server reads candidate credentials line by line and compares them against client-supplied values. The pre-1.6.42 implementation used standard memcmp(), which short-circuits on the first byte mismatch - leaking information about how many leading bytes matched via response latency. This is a textbook CWE-208 (Observable Timing Discrepancy / Observable Discrepancy) issue affecting cpe:2.3:a:memcached:memcached:*. The fix replaces memcmp() with safe_memcmp(), a constant-time comparison routine, and also zeroes the read buffer before each fgets() to eliminate residual data side-channels.

RemediationAI

Vendor-released patch: upgrade memcached to version 1.6.42 or later, which replaces memcmp() with the constant-time safe_memcmp() in sasl_server_userdb_checkpass (commit d13f282b4bce33a9c33b8a1bbf07f12114160fed). Operators unable to upgrade immediately should restrict access to memcached's listening port (default 11211) to trusted hosts via host-based firewall rules or network ACLs, eliminating the remote timing channel at the cost of breaking any legitimate remote clients. As an alternative, switch SASL authentication away from the file-based userdb backend to a Cyrus SASL backend (e.g., sasldb or PAM) that performs comparisons outside the vulnerable code path, accepting the operational overhead of an external authentication store. See https://github.com/memcached/memcached/wiki/ReleaseNotes1642 for full release details.

More in Memcached

View all
CVE-2016-8706 HIGH POC
8.1 Jan 06

An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of

CVE-2016-8704 CRITICAL POC
9.8 Jan 06

An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multipl
CVE-2016-8705 CRITICAL POC
9.8 Jan 06

Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple com
CVE-2022-26635 CRITICAL POC
9.8 Apr 05

PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. R
CVE-2017-9951 HIGH POC
7.5 Jul 17

The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of ser
CVE-2020-10931 HIGH POC
7.5 Mar 24

Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary pr
CVE-2019-11596 HIGH POC
7.5 Apr 29

In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. Rated hi
CVE-2018-1000115 HIGH POC
7.5 Mar 05

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vuln
CVE-2023-46853 CRITICAL
9.8 Oct 27

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used inste
CVE-2026-47783 HIGH
8.1 May 20

Observable timing discrepancy in memcached prior to version 1.6.42 enables remote attackers to enumerate valid SASL auth
CVE-2023-46852 HIGH
7.5 Oct 27

In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many

CVE-2019-15026 HIGH
7.5 Aug 30

memcached 1.5.16, when UNIX sockets are used, has a stack-based buffer over-read in conn_to_str in memcached.c. Rated hi

Same weakness CWE-208 – Observable Timing Discrepancy

View all
CVE-2026-23519 CRITICAL POC
9.8
CVE-2024-47178 HIGH POC
8.7
CVE-2026-69247 HIGH POC
8.2
CVE-2025-68621 HIGH POC
7.4
CVE-2024-7010 MEDIUM POC
5.9
CVE-2021-26314 MEDIUM POC
5.5
CVE-2026-23849 MEDIUM POC
5.3
CVE-2025-30344 MEDIUM POC
5.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

Share

EUVD-2026-31069 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy