PT-2026-42110 · Memcached+2 · Memcached+2

Kingroryga · Published 2026-05-20 · Updated 2026-05-30 · CVE-2026-47784

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions memcached versions prior to 1.6.42

Description Password data for SASL password database authentication contains a timing side channel. This occurs because the sasl server userdb checkpass() function utilizes memcmp, which can allow an attacker to infer information about the password based on the time taken to perform the comparison.

Recommendations Update to version 1.6.42 or later.

Fix

Weakness Enumeration

CWE-208

Related Identifiers

BIT-MEMCACHED-2026-47784

CVE-2026-47784

OPENSUSE-SU-2026:10882-1

USN-8320-1

Affected Products

Linuxmint

Ubuntu

Memcached

References · 25

• https://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed · Patch
• https://ubuntu.com/security/notices/USN-8320-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47784 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-47784 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47784 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-47783 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10882-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47784 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-47784 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8320-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47784 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-memcached-2026-47784 · Vendor Advisory
• https://github.com/memcached/memcached/wiki/ReleaseNotes1642 · Note
• https://github.com/memcached/memcached/compare/1.6.41...1.6.42 · Note
• https://t.me/netlas/576 · Telegram Post