CVE-2026-47783

HIGH8.1EPSS 0.08%

發布日:2026/5/20修改日:2026/5/29

描述

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

受影響套件(2)

Bitnami/memcachedfrom 0, < 1.6.42
Debian/memcachedfrom 0, < 1.6.9+dfsg-1+deb11u1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.1	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

參考連結(5)

ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-47783
WEBhttps://github.com/memcached/memcached/commit/d13f282b4bce33a9c33b8a1bbf07f12114160fed
WEBhttps://github.com/memcached/memcached/compare/1.6.41...1.6.42
WEBhttps://github.com/memcached/memcached/wiki/ReleaseNotes1642
WEBhttps://nvd.nist.gov/vuln/detail/CVE-2026-47783