Executive brief
Memcached is an in-memory caching system widely used to accelerate application performance. When ASCII protocol authentication is enabled, a remote attacker can send specially crafted empty newline sequences to trigger an out-of-bounds memory read, causing the service to crash and disrupting dependent applications.
Technical details
An out-of-bounds read vulnerability exists in the try_read_command_asciiauth function of proto_text.c in memcached's ASCII protocol tokenizer when authentication is enabled. The vulnerability occurs when empty newlines are sent to the server, causing the tokenizer to attempt reading a short string without proper bounds checking. The attack is network-accessible and requires no authentication or user interaction. An attacker can remotely crash the memcached service, resulting in denial of service to dependent applications. The vulnerability affects versions 1.6.41, 1.6.42, and 1.6.43, and is fixed in version 1.6.44 by commit af05c9302bba508b736c3da1d5670f63fe8b7db4.
Affected products
- memcached memcached 1.6.41, 1.6.42, 1.6.43
Timeline
- 2026-09-14: disclosed
- 2026-09-14: patched: Version 1.6.44 available