CVE-2017-9951: High severity Memcached Memcached vulnerability
Last updated 25 August 2025
Other sources
The tryreadcommand function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2017-9951.
What is the severity of CVE-2017-9951?
The severity of CVE-2017-9951 is high with a severity value of 7.5.
How does CVE-2017-9951 allow remote attackers to cause a denial of service?
CVE-2017-9951 allows remote attackers to cause a denial of service by triggering a heap-based buffer over-read through a request to add/set a key.
Which versions of memcached are affected by CVE-2017-9951?
Versions before 1.4.39 of memcached are affected by CVE-2017-9951.
How can I fix CVE-2017-9951?
To fix CVE-2017-9951, update memcached to version 1.4.39 or later.