memcached Timing Side Channel (CVE-2026-47783) Allows SASL Credential Guessing

The National Vulnerability Database has disclosed CVE-2026-47783, a high-severity timing side channel vulnerability in memcached versions prior to 1.6.42. This flaw, rated 8.1 CVSS, exists within the SASL password database authentication mechanism. Specifically, the sasl_server_userdb_checkpass function exits its loop as soon as a valid username is found, creating a measurable time difference that attackers can exploit.

This timing disparity allows a sophisticated attacker to enumerate valid usernames on a memcached instance configured with SASL authentication. While it doesn’t directly expose passwords, successful username enumeration significantly reduces the attacker’s brute-forcing efforts, making it easier to compromise accounts. This is a classic CWE-208 vulnerability, where observable differences in execution time leak sensitive information.

Defenders must prioritize patching memcached instances to version 1.6.42 or later. Organizations relying on SASL for memcached authentication should also review their authentication logs for any unusual or repetitive username attempts, which could indicate active exploitation of this timing side channel. This vulnerability underscores the importance of secure coding practices that prevent information leakage through execution timing.