Information Exposure Through Timing Discrepancy in memcached - CVE-2026-47784

Vulnerability identifier: #VU132320

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-47784

CWE-ID: CWE-208

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to disclose password information via a timing side channel.

The vulnerability exists due to observable timing discrepancies in sasl_server_userdb_checkpass when comparing SASL password database authentication data. A remote user can send authentication attempts and measure response times to disclose password information via a timing side channel.

memcached
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools for SLE
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
Anolis OS
memcached
memcached-devel
memcached-debuginfo
memcached-debugsource
memcached (Ubuntu package)
memcached-help
memcached-selinux
memcached-doc

Install security update from vendor's website.

memcached - update to 1.6.42
memcached - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached-devel - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached-debuginfo - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached-debugsource - addressed in versions 1.4.39-4.14.1, 1.5.6-150000.4.10.1
memcached (Ubuntu package) - addressed in versions 1.6.14-1ubuntu0.2, 1.6.24-1ubuntu0.1, 1.6.38-1ubuntu0.1, 1.6.40-1ubuntu0.1
memcached-devel - update to 1.6.22-5
memcached-help - update to 1.6.22-5
memcached-selinux - update to 1.6.22-5
memcached-debugsource - update to 1.6.22-5
memcached-debuginfo - update to 1.6.22-5
memcached - update to 1.6.22-5
memcached - update to 1.6.23-2
memcached-doc - update to 1.6.23-2
memcached-selinux - update to 1.6.23-2
memcached-devel - update to 1.6.23-2

• https://www.openwall.com/lists/oss-security/2026/05/24/7
• https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed

• Two vulnerabilities in Memcached SASL implementation
• Anolis OS update for memcached
• Ubuntu update for memcached
• openEuler update for memcached
• SUSE update for memcached
• SUSE update for memcached