Loading story…
Memcached released version 1.6.42 to fix two high-severity SASL authentication timing side-channel vulnerabilities affecting versions prior to 1.6.42. The flaws, tracked as CVE-2026-47783 and CVE-2026-47784, can let attackers infer valid usernames and extract password information through response-time analysis. According to the disclosures, one bug leaked username-related information because authentication logic stopped searching once it found a valid user, while the other exposed password-related information because password checks relied on memcmp, enabling byte-by-byte timing differences.
The maintainers described 1.6.42 as a major security-focused release and urged users to upgrade immediately. In addition to the SASL fixes, the release addressed a broad set of security and stability problems, including memory corruption risks, crashes, signed integer overflow in binary protocol body-length handling, authentication reload races, malformed-input handling issues, proxy parsing flaws, extstore and slab reassignment bugs, and other denial-of-service conditions. The exposure is especially relevant where Memcached is reachable from untrusted networks, cloud deployments, or loosely segmented microservices environments, where the timing leaks could aid reconnaissance, brute-force attempts, or credential-stuffing activity.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-19, an oss-sec post reported that MITRE had assigned CVE-2026-47783 and CVE-2026-47784 to two timing side-channel flaws affecting Memcached versions before 1.6.42. The disclosure explained that one flaw leaks username-related information during SASL authentication and the other can leak password information due to use of memcmp, and noted both were fixed in 1.6.42.
Memcached released version 1.6.42 on 2026-05-18 as a major security-focused update and strongly advised users to upgrade. The release fixed numerous security and stability issues across SASL authentication, binary protocol handling, proxy code, extstore behavior, slab reassignment, and related components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourceseclists.org
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MongoDB disclosed multiple vulnerabilities in **MongoDB Server** and the **MongoDB Java Driver**, including one critical issue and at least 16 high-severity flaws that can lead to remote code execution, information disclosure, authentication bypass, data manipulation, and denial of service. National cyber agencies in Italy, Canada, and Guyana published advisories urging organizations to review MongoDB’s security bulletins and update affected deployments. A key server-side issue, **`CVE-2026-18691`** / **`SERVER-130264`**, affects intra-cluster SASL egress connection setup and can allow an attacker with adjacent network access to downgrade authentication to **`PLAIN`**, exposing a cleartext keyfile and potentially enabling authentication as MongoDB’s internal superuser. Advisories say the server flaw affects versions before **`7.0.40`**, **`8.0.29`**, **`8.2.13`**, **`8.3.8`**, and **`9.0.0-rc2`**, while the Java Driver issue **`JAVA-6266`** affects versions **`4.11.0`** through **`5.9.1`** and can expose a proxy password through `ProxySettings.toString`; administrators are advised to upgrade to patched releases immediately.
Aug 14, 2026
A high-severity flaw tracked as **CVE-2026-71272** affects `usememos/memos` versions up to and including `0.29.1`, allowing attackers to bypass webhook SSRF protections through a DNS rebinding time-of-check/time-of-use weakness. The issue lies in `safeDialContext()` in `internal/webhook/webhook.go`, where the application validates IP addresses from an initial DNS lookup but later connects using the original hostname, triggering a second DNS resolution at dial time that an attacker-controlled DNS server can change. The vulnerability is classified as **CWE-367** and carries a **CVSS v3.1** vector of `AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N`, indicating low attack complexity and high confidentiality impact. The affected webhook component was designed to block connections to private and reserved IP ranges and supports signed webhook delivery with HMAC-SHA256, but the hostname re-resolution behavior undermines those safeguards when an attacker can control DNS responses for the webhook target.
Aug 6, 2026
Security advisories warned of two severe database software vulnerabilities with immediate internet-facing risk. In MongoDB, an unauthenticated network attacker can trigger an information disclosure flaw—described in some reporting as **MongoBleed**—to make a vulnerable server return sensitive data such as credentials, secrets, and personal information. The issue affects MongoDB releases dating back to about 2017 and stems from insufficient validation in the `zlib` implementation, which can leak uninitialized heap memory allocated to MongoDB. Working exploitation methods are known, and defenders were told to watch for large volumes of malformed or compressed requests, decompression or memory-handling errors, and repeated unauthenticated connections. Patches are available in versions `8.2.3`, `8.0.17`, `7.0.28`, `6.0.27`, `5.0.32`, and `4.4.30`, while end-of-life branches remain unpatched. A separate advisory disclosed a **critical Redis vulnerability** affecting `8.2.1` and earlier when Lua scripting is enabled, which is the default configuration. The flaw is a use-after-free condition that can be triggered by a specially crafted Lua script and may allow **remote arbitrary code execution**, giving an attacker full control of the host running Redis. Officials urged immediate upgrades because the vulnerability is publicly known and exploitation could begin within hours, and they advised organizations to inspect any previously exposed Redis environments for signs of compromise. Fixed versions were listed as `6.2.20`, `7.2.11`, `7.4.6`, `8.0.4`, and `8.2.2`, alongside renewed guidance that Redis instances should not be exposed directly to the public internet.
Jun 29, 2026