CVE-2026-47784 is a timing side channel vulnerability in memcached's SASL authentication mechanism. The flaw allows remote attackers to exploit timing differences during password verification to infer sensitive password information, potentially leading to unauthorized access. The vulnerability is tracked under CWE-208 (Observable Timing Discrepancy). The Red Hat advisory references an update to memcached packages (version 1.6.42-0.1.hum1) as part of Red Hat Hardened Images RPMs. The advisory does not explicitly confirm a patch but provides mitigation guidance including network access restrictions and SASL configuration adjustments.

The vulnerability can lead to unauthorized access to memcached instances by leaking sensitive password data through timing side channels during SASL authentication. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild. The impact is rated medium by Red Hat, with a CVSS base score of 5.9 assigned by Red Hat and a higher score of 8.1 by cve.org, reflecting differences in scoring methodology.

No explicit official patch is confirmed in the advisory; however, an update including memcached-1.6.42-0.1.hum1 is available. Until a confirmed patch is applied, mitigate by restricting memcached network access to trusted clients using firewall rules, disabling SASL authentication if not required, or ensuring strong, unique passwords with regular rotation if SASL is necessary. Binding memcached to localhost is also recommended to limit exposure. Restarting memcached after configuration changes will clear cached data.