The vulnerability lies in Memcached’s SASL authentication routine. When the server checks a supplied username, it exits the loop as soon as a match is found, creating a timing side channel that reveals whether a username exists in the SASL password database. The flaw does not disclose passwords but enables username enumeration, which can accelerate subsequent credential‑guessing attacks.

Memcached servers running the memcached daemon prior to version 1.6.42 are affected. The issue appears in all releases up through 1.6.41 inclusive. Any unsupported builds that still ship the old SASL password database implementation remain vulnerable.

The CVSS score of 8.1 indicates high severity. EPSS data is not available, so precise exploitation likelihood is unclear. The likely attack vector is over the network via the SASL interface, as the flaw requires only remote access to the memcached service. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploits have been documented. Based on the description, an attacker could send repeated SASL authentication attempts, measuring timing differences, to enumerate usernames on exposed servers.