redhat/memcached vulnerabilities

Latest redhat/memcached CVEs

Newest publication first

1. CVE-2026-90698 memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds

   Published 2026-09-14

   Medium·CVSS 6.9 EPSS 0.86%

   A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack...

2. CVE-2026-47784 In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

   Published 2026-05-20

   High·CVSS 8.1 EPSS 0.55%

   In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

3. CVE-2026-47783 In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

   Published 2026-05-20

   High·CVSS 8.1 EPSS 1.3%

   In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.