CVE-2026-47783: High severity Memcached Memcached vulnerability
In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by saslserveruserdbcheckpass.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/memcachedto a version that resolves this vulnerability.Fixed in 1.6.9+dfsg-1+deb11u1Fixed in 1.6.42-1 - Upgrade
Upgrade
memcachedto a version that resolves this vulnerability.Fixed in 1.6.42
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47783?
CVE-2026-47783 is classified as a medium severity vulnerability due to its potential for username enumeration through timing attacks.
How do I fix CVE-2026-47783?
To fix CVE-2026-47783, upgrade to memcached version 1.6.42 or later.
What impact does CVE-2026-47783 have on system security?
CVE-2026-47783 can allow attackers to exploit timing side channels to enumerate valid usernames, potentially leading to unauthorized access.
Which versions of memcached are affected by CVE-2026-47783?
CVE-2026-47783 affects all versions of memcached prior to 1.6.42.
What is the primary cause of the CVE-2026-47783 vulnerability?
The vulnerability in CVE-2026-47783 is caused by a timing side channel in the SASL password database authentication loop.