CVE-2026-47784
Fixed in a distro release EPSS <1%CVSS 8.1
In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.
Products: Memcached
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian:12 | memcached | 1.6.18-1+deb12u1 |
| Debian:13 | memcached | no fix |
| Debian:14 | memcached | 1.6.42-1 |
| Red Hat:hummingbird:1 | memcached | 0:1.6.42-0.1.hum1 |
| Red Hat:hummingbird:1 | memcached-devel | 0:1.6.42-0.1.hum1 |
| Red Hat:hummingbird:1 | memcached-selinux | 0:1.6.42-0.1.hum1 |
| SUSE:Linux Enterprise Server 16.0 | memcached | 1.6.38-160000.3.1 |
| SUSE:Linux Enterprise Server for SAP applications 16.0 | memcached | 1.6.38-160000.3.1 |
| Ubuntu:20.04:LTS | memcached | no fix |
| Ubuntu:22.04:LTS | memcached | 1.6.14-1ubuntu0.2 |
| Ubuntu:24.04:LTS | memcached | 1.6.24-1ubuntu0.1 |
| Ubuntu:25.10 | memcached | 1.6.38-1ubuntu0.1 |
| Ubuntu:26.04:LTS | memcached | 1.6.40-1ubuntu0.1 |
| Ubuntu:Pro:16.04:LTS | memcached | no fix |
| Ubuntu:Pro:18.04:LTS | memcached | no fix |
| openSUSE:Tumbleweed | memcached | 1.6.42-1.1 |