Information Exposure Through Timing Discrepancy in memcached - CVE-2026-47783

Vulnerability identifier: #VU132319

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47783

CWE-ID: CWE-208

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to disclose valid usernames.

The vulnerability exists due to observable timing discrepancies in sasl_server_userdb_checkpass when processing SASL password database authentication requests. A remote user can send authentication attempts and measure response times to disclose valid usernames.

memcached
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
memcached
memcached-devel
memcached-debuginfo
memcached-debugsource
memcached (Red Hat package)
memcached (Ubuntu package)
memcached-help
memcached-selinux

Install security update from vendor's website.

memcached - update to 1.6.42
memcached - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached-devel - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached-debuginfo - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached-debugsource - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached (Red Hat package) - addressed in versions 1.6.9-7.el9_8.1, 1.6.23-7.el10_2.1
memcached (Ubuntu package) - addressed in versions 1.6.14-1ubuntu0.2, 1.6.24-1ubuntu0.1, 1.6.38-1ubuntu0.1, 1.6.40-1ubuntu0.1
memcached-help - update to 1.6.22-5
memcached-selinux - update to 1.6.22-5
memcached-devel - update to 1.6.22-5
memcached-debugsource - update to 1.6.22-5
memcached-debuginfo - update to 1.6.22-5
memcached - update to 1.6.22-5

• https://www.openwall.com/lists/oss-security/2026/05/24/7
• https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed

• Two vulnerabilities in Memcached SASL implementation
• Ubuntu update for memcached
• openEuler update for memcached
• SUSE update for memcached
• SUSE update for memcached
• Red Hat Enterprise Linux 10 update for memcached
• Red Hat Enterprise Linux 9 update for memcached