Memcached SASL Vulnerability Allows Username Enumeration Attacks

A timing side-channel vulnerability in Memcached's SASL authentication mechanism, tracked as CVE-2026-47783, has been disclosed. This flaw affects versions prior to 1.6.42 and enables attackers to enumerate valid usernames. The vulnerability was confirmed by researchers and poses a significant risk to systems using Memcached for password database authentication. The flaw was addressed in the latest release, which includes multiple critical bug fixes. Security professionals are urged to update their systems to mitigate potential exploitation. The vulnerability was published on May 20, 2026.

Key Points: • CVE-2026-47783 allows username enumeration via a timing side-channel attack. • Affected versions of Memcached are those prior to 1.6.42. • The vulnerability was patched in the recent Memcached update released on May 20, 2026.