In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.42CPE matchmatch criteria | cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:* | ||
>= 0, < 1.6.42CPE match | cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Memcached vulnerabilities
May 27, 2026In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
May 12, 2026