memcached EUVD-2026-31069

Target must be running memcached built with SASL support AND configured to use the file-based SASL userdb backend that routes through sasl_server_userdb_checkpass - neither is the default deployment for most installations. Attacker requires network reachability to the memcached port (typically 11211) and a sufficiently stable, low-latency path to distinguish microsecond-scale memcmp() short-circuit timing variations from network jitter, which is reflected in the CVSS AC:H rating. No authentication or user interaction is required (PR:N/UI:N), but practical exploitation needs many repeated probes, so rate limiting or connection throttling on the network path materially limits feasibility.

The CVSS 8.1 score combines AV:N (network reachable), AC:H (high attack complexity - reflecting the statistical work needed to extract usable signal from network-timing noise), PR:N (unauthenticated), and a full C:H/I:H/A:H impact set once credentials are recovered. Real-world risk is moderated by several factors: memcached is typically deployed on internal networks where network jitter further degrades timing measurements, SASL authentication on memcached is an opt-in non-default feature, and the AC:H rating reflects that practical exploitation requires many measurements with low-latency network access. No EPSS, KEV, or POC data was provided, and no public exploit identified at time of analysis. The C:H/I:H/A:H impact rating assumes full administrative credential recovery, which would yield complete access to cached data; for read-only caches the actual integrity/availability impact may be lower than scored.

A remote attacker with network reachability to a memcached instance using SASL userdb authentication issues a large number of authentication attempts with crafted username/password candidates, measuring the server's response latency for each. By statistically aggregating timing differences across many trials, the attacker progressively recovers stored passwords byte by byte and ultimately authenticates as a legitimate user to read or manipulate cached data.