Memcached CVE-2026-47783: Brief Summary of the SASL Timing Side Channel Vulnerability

Introduction

A timing side channel in memcached's SASL authentication routine let remote, unauthenticated attackers tell valid usernames from invalid ones. It could also let them extract password bytes one at a time through precise network timing measurements. For organizations running memcached with SASL enabled over the binary protocol, this CVSS 8.1 vulnerability (CVE-2026-47783) in versions before 1.6.42 exposed credential material to anyone who could reach the service, with no prior access required.

Technical Information

The root cause of CVE-2026-47783 is in the sasl_server_userdb_checkpass function, which handles SASL password database authentication in memcached. This code path contained two independent timing side channels, both classified under CWE-208 (Observable Timing Discrepancy).

Username Enumeration via Early Loop Exit

When processing an authentication request, the function iterated through the password file looking for a matching username. When it found a valid username, the loop broke out immediately and moved on to password verification. For an invalid username, the loop kept scanning the entire file before returning a failure. That difference created a measurable timing discrepancy: requests with valid usernames returned faster (or slower, depending on the username's position in the file) than requests with invalid usernames. An attacker who could send repeated authentication attempts and measure the response times could statistically distinguish valid usernames from invalid ones.

Password Byte Leakage via Non-Constant-Time Comparison

Once a valid username was found, the password comparison used the standard C library memcmp function. memcmp is optimized for performance and returns as soon as it hits the first differing byte. If the first byte of the attacker's guess matches the stored password, memcmp goes on to the second byte before returning, which takes slightly longer. By trying every possible value at each byte position and noting which guess takes marginally longer, an attacker could reconstruct the password one byte at a time.

Attack Flow

An attacker targeting this vulnerability would follow this general approach:

1. Identify a memcached instance with SASL authentication enabled over the binary protocol.
2. Send repeated authentication requests with candidate usernames and measure the response time for each. Usernames that produce statistically different response times are likely valid.
3. Once a valid username is confirmed, start extracting the password by sending authentication requests with systematically varied password guesses, timing each response.
4. For each byte position, the guess that produces a slightly longer response time indicates a correct byte match, because memcmp went on to compare the next byte before returning.
5. Repeat across all byte positions to reconstruct the full password.

Exploitation Prerequisites

The CVSS vector string is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Attack complexity is rated High because extracting credentials through timing analysis over a network takes many repeated measurements and statistical analysis to overcome network jitter and other noise. The attack is network exploitable (AV:N) and requires no privileges (PR:N) or user interaction (UI:N). If it succeeds, the confidentiality, integrity, and availability impacts are all rated High.

Exploitation is limited to memcached deployments that meet all of the following conditions:

• Memcached was built with SASL support enabled.
• SASL authentication is actively configured.
• The binary protocol is in use.

Code-Level Remediation

The fix, in commit d13f282, closes both timing channels with three changes:

1. The early break is gone. The loop now always scans the entire password file, regardless of when (or whether) it finds a matching username, so valid and invalid username lookups take the same time.
2. memcmp is replaced with safe_memcmp, which performs constant-time comparisons. The comparison takes the same amount of time wherever the first differing byte occurs.
3. The buffer is cleared to zero with memset before each fgets call. Comparisons that run past the stored password then hit known zero bytes instead of leftover data from previous iterations.

Affected Systems and Versions

All versions of memcached prior to 1.6.42 are affected when the following configuration conditions are met:

• SASL support is compiled into the memcached binary.
• SASL password database authentication is enabled.
• The binary protocol is in use.

Memcached version 1.6.42 and later contain the fix for this vulnerability.

Vendor Security History

Memcached has a notable history of security incidents tied to deployment and configuration practices. In February 2018, attackers used misconfigured memcached servers to launch record-breaking distributed denial of service amplification attacks, with traffic volumes reaching 1.35 terabits per second. The root cause was a massive amplification factor in the UDP protocol, and the project responded by disabling UDP by default starting in version 1.5.6.

The maintainers describe 1.6.42 as a major security-focused release. Besides this timing side channel, it fixes numerous memory corruption and crash vulnerabilities. The maintainers noted a very high volume of security reports addressed in this one release, which suggests a period of concentrated security auditing and remediation.

References

• CVE Record: CVE-2026-47783
• NVD: CVE-2026-47783
• Fix timing side channel in SASL password database authentication (commit d13f282)
• Memcached 1.6.41 to 1.6.42 comparison
• Memcached 1.6.42 Release Notes
• Binary SASL Auth: Memcached Documentation
• oss-sec: Memcached 1.6.42 security focused release
• CISA Known Exploited Vulnerabilities Catalog