In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade memcachedUpgrade memcached-selinux | Jun 24, 2026 | Jun 22, 2026 |
| Amazon_linux_2023 | — | Upgrade memcached-debugsourceUpgrade memcachedUpgrade memcached-selinuxUpgrade memcached-develUpgrade memcached-debuginfo | Jun 9, 2026 | May 20, 2026 |
| Debian | — | Upgrade memcached | May 27, 2026 | May 27, 2026 |
| Redhat_linux | — | Upgrade memcached-debugsourceUpgrade memcached-debuginfoUpgrade memcached-selinuxUpgrade memcached | Jun 24, 2026 | May 20, 2026 |
| Rocky_linux | — | Upgrade memcached-debuginfoUpgrade memcachedUpgrade memcached-selinuxUpgrade memcached-debugsource | Jun 29, 2026 | Jun 24, 2026 |
| Ubuntu | — | Upgrade memcached | May 27, 2026 | May 27, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jun 29, 2026 | May 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub