Description
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | memcached | 1.6.41, 1.6.42, 1.6.43 | 1.6.44 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | memcached | 1.6.45-1 | — |
| Debian 13 | memcached | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | memcached | 1.6.40-1ubuntu0.3 | USN-8792-1 |
| Ubuntu 24.04 LTS | memcached | 1.6.24-1ubuntu0.3 | USN-8792-1 |
| Ubuntu 22.04 LTS | memcached | 1.6.14-1ubuntu0.3 | USN-8792-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | memcached +2 | 1.6.45-1.hum1 | RHSA-2026:63224 |
Advisories 3
- RHSA-2026:63224 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Sep 22, 2026
- WID-SEC-2026-3336 memcached: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 21, 2026
- USN-8792-1 memcached vulnerability Ubuntu Security Notices (USN) · Sep 21, 2026
References
- VDB-403231 | memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds vdb-entry technical-description
- VDB-403231 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-90698 | CVE Analysis and Report third-party-advisory
- Submit #916217 | Memcached 1.6.41 through 1.6.43 Out-of-Bounds Read third-party-advisory
- Submit #916219 | Memcached 1.6.41 > 1.6.43 Out-of-Bounds Read (Duplicate) third-party-advisory
- https://protectiv.ph/research/memcached-asciiauth-empty-line-dos exploit
- https://github.com/memcached/memcached/commit/af05c9302bba508b736c3da1d5670f63fe8b7db4 patch
- https://github.com/memcached/memcached/releases/tag/1.6.44 patch
- https://github.com/memcached/memcached/ product