CVE-2026-47784: 
Memcached vulnerability analysis and mitigation

CVE-2026-47784 is a timing side-channel vulnerability in memcached's SASL password database authentication mechanism, affecting all versions before 1.6.42. The flaw exists in the sasl_server_userdb_checkpass() function, which used the non-constant-time memcmp() for both username and password comparisons, and also broke out of the password file loop early upon finding a valid username — creating measurable timing differences exploitable by remote attackers. It was published on May 20, 2026, with the fix committed on May 18, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-208 (Observable Timing Discrepancy). In sasl_defs.c, the sasl_server_userdb_checkpass() function used memcmp() — which returns early on the first differing byte — to compare both usernames and passwords against entries in the SASL password file. Additionally, the function broke out of the file-scanning loop immediately upon finding a matching username, creating a distinct timing difference between valid and invalid usernames. An unauthenticated network attacker can exploit these timing differences by sending many crafted SASL authentication attempts and statistically analyzing response times to infer valid credentials character by character. The fix replaced memcmp() with a constant-time safe_memcmp() function, cleared the buffer before each read, and removed the early loop break so the entire file is always scanned (memcached commit, GitHub Advisory).

A successful timing attack allows an unauthenticated remote attacker to gradually infer valid SASL credentials (both usernames and passwords) without direct access to the password database, effectively bypassing authentication. Once valid credentials are obtained, the attacker gains unauthorized access to the memcached instance with the privileges of a legitimate user, enabling them to read, modify, or delete cached data — which may include sensitive application data such as session tokens, user records, or API responses. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, reflecting the full scope of access an authenticated memcached user can achieve (GitHub Advisory, Red Hat Bugzilla).

1. Identify target: Locate memcached instances with SASL authentication enabled (typically on port 11211) using network scanning tools such as Nmap or Shodan, targeting deployments running versions prior to 1.6.42.
2. Establish network proximity: Position the attack platform on a low-latency network path to the target to minimize timing noise, as the timing differences exploited are subtle and can be obscured by network jitter.
3. Username enumeration via timing: Send repeated SASL authentication requests with candidate usernames and a fixed password. Measure response times: the early loop break in vulnerable versions causes a measurable latency difference when a valid username is found versus an invalid one. Statistically aggregate many samples to identify valid usernames.
4. Password inference via timing: With a confirmed valid username, send authentication attempts varying the password one character at a time. The non-constant-time memcmp() returns faster on early mismatches, allowing character-by-character inference of the correct password through statistical timing analysis.
5. Authenticate and access: Use the recovered credentials to authenticate to the memcached instance via SASL, gaining full read/write access to cached data (memcached commit, GitHub Advisory).

• Network: High volume of SASL authentication attempts (repeated failed/successful AUTHENTICATE commands) to memcached port 11211 from a single source IP, particularly with slight variations in username or password fields.
• Network: Unusual patterns of authentication traffic from unexpected source IPs or geographic locations targeting memcached endpoints.
• Logs: Memcached logs showing a large number of authentication failures followed by a successful authentication from the same source, indicative of a brute-force or timing-based credential recovery attempt.
• Logs: Repeated SASL AUTHENTICATE commands with systematically varying credential strings in memcached access logs.
• Process/Behavior: Unexpected read or write operations on cached data immediately following a successful SASL authentication from an unfamiliar client.

Upgrade memcached to version 1.6.42 or later, which replaces the vulnerable memcmp() calls with a constant-time safe_memcmp() and eliminates the early loop exit in sasl_server_userdb_checkpass() (memcached commit, Release Notes). Downstream patches are available from Red Hat (RHSA-2026:23261), SUSE (SUSE-SU-2026:2292-1), Amazon Linux 2023 (ALAS2023-2026-1781), openSUSE, Debian, and Ubuntu. Where immediate patching is not feasible, restrict network access to memcached instances to trusted networks only using firewall rules, and consider disabling SASL authentication if it is not required for the deployment.

The vulnerability received coverage from security news outlets including SecurityOnline and CyberPress, which highlighted the SASL timing attack risk. It appeared in Reddit's CVE Watch trending lists for May 27–28, 2026, indicating moderate community interest. The memcached maintainer (dormando) described version 1.6.42 as a "major security focused release" addressing multiple issues simultaneously, noting the high volume of security reports in this cycle (Release Notes). Multiple Linux distributions including Red Hat, SUSE, Debian, Ubuntu, and Amazon Linux issued security advisories and updated packages promptly after the upstream fix was released.