Description
memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | memcached | 1.5.0-1 | — |
| Debian 13 | memcached | 1.5.0-1 | — |
| Debian 12 | memcached | 1.5.0-1 | — |
| Debian 9 | memcached | 1.4.33-1+deb9u1 | DSA-4218-1 |
| Debian 8 | memcached | 1.4.21-1.1+deb8u2 | DSA-4218-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | memcached | 1.4.13-0.2+deb7u4 | DLA-1329-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | memcached | 1.4.25-2ubuntu1.4 | USN-3601-1 |
| Ubuntu 14.04 LTS | memcached | 1.4.14-0ubuntu9.3 | USN-3601-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 10 | memcached | 1.4.39-2.el7ost | RHSA-2018:2290 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | memcached | 1.6.9-2.3 | openSUSE-SU-2024:11045-1 |
Advisories 5
- RHSA-2018:2290 Red Hat Security Advisory: memcached security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4218-1 memcached - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1329-1 memcached - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3601-1 memcached vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11045-1 memcached-1.6.9-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- RHSA-2018:2290 vendor-advisory
- [debian-lts-announce] 20180329 [SECURITY] [DLA 1329-1] memcached security update mailing-list
- https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00
- USN-3601-1 vendor-advisory
- DSA-4218 vendor-advisory
- https://github.com/memcached/memcached/wiki/ReleaseNotes1437
- https://github.com/memcached/memcached/issues/271