Critical Security Flaw in memcached: Username Enumeration via Timing Side Channel
Summary
RLSA-2026:27842: Important: memcached security update. Affects memcached versions < 0:1.6.23-7.el10_2.1. Fixed in 0:1.6.23-7.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
memcached is a high-performance, distributed memory object caching system designed to speed up dynamic web applications by reducing database load. It is widely used in various web applications to enhance performance and scalability. However, it is susceptible to security vulnerabilities that can compromise its integrity and the applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2026-47783 allows for username enumeration through a timing side channel. This means that an attacker can exploit the time taken by the server to respond to specific requests to infer valid usernames. This can lead to unauthorized access or further attacks on the application, as attackers can gather information about user accounts without direct interaction.
How To Fix
Minimum fixed version
0:1.6.23-7.el10_2.1
This is the first release that contains the fix.
sudo dnf update memcachedTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing additional security measures such as rate limiting on login attempts or using CAPTCHA to mitigate the risk of enumeration attacks.
Conclusion
The memcached vulnerability CVE-2026-47783 poses a significant risk to applications relying on this caching system. It is crucial to update to the latest patched version to mitigate potential attacks. Additionally, implementing workarounds can help protect against exploitation until an update can be applied.
See every vulnerability recorded for memcached →
FAQ
CVE-2026-47783 is a vulnerability in memcached that allows attackers to enumerate valid usernames through timing analysis.
This vulnerability can lead to unauthorized access as attackers can identify valid usernames, potentially allowing them to launch further attacks.
The CVSS score for this vulnerability is 8.1, indicating a high level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update immediately, consider implementing security measures such as rate limiting or CAPTCHA to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for memcached.
