Multiple integer overflows in processbinupdate function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

An integer overflow in the processbinappendprepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by saslserveruserdbcheckpass.

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by saslserveruserdbcheckpass.

An integer overflow in processbinsaslauth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Last updated 25 August 2025

Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted binary protocol header to tryreadcommandbinary in memcached.c.

In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru tempttl" commands. This causes a denial of service when parsing crafted lru command messages in processlrucommand in memcached.c.

Last updated 25 August 2025

A flaw was found in memcached version prior to 1.4.37. It contains an Integer Overflow vulnerability in items.c:itemfree() that can result in resource leaks or data corruption, deadlocks and crashes due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service.

References: https://github.com/memcached/memcached/issues/271 https://github.com/memcached/memcached/wiki/ReleaseNotes1437

Upstream Patch: https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00

Last updated 25 August 2025

In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.

memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.

Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted meta command.

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by saslserveruserdbcheckpass.

Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.

Multiple integer signedness errors in the (1) processbinsaslauth, (2) processbincompletesaslauth, (3) processbinupdate, and (4) processbinappendprepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Description of problem:

When run with "-vv", on receipt of a binary-protocol deletion request, memcached prints out the key to be deleted in a way that can lead to a buffer overrun and crash.

Version-Release number of selected component (if applicable):

1.4.4, although this currently affects all later versions.

How reproducible:

Run memcached with "-vv", use memrm to send deletion requests and observe output.

Steps to Reproduce:

1. memcached -p 12345 -vv 2>&1 | grep '^Deleting' 2. memrm --servers localhost:12345 --binary ABCDEF xyz 3. Check the output from memcached.

Actual results:

[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyzDEF

Expected results:

[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyz

Additional info:

I've opened a bug report upstream: https://code.google.com/p/memcached/issues/detail?id=306

memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.

The doitemget function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.

Description of problem:

When run with "-vv", on receipt of a binary-protocol deletion request, memcached prints out the key to be deleted in a way that can lead to a buffer overrun and crash.

Version-Release number of selected component (if applicable):

1.4.4, although this currently affects all later versions.

How reproducible:

Run memcached with "-vv", use memrm to send deletion requests and observe output.

Steps to Reproduce:

1. memcached -p 12345 -vv 2>&1 | grep '^Deleting' 2. memrm --servers localhost:12345 --binary ABCDEF xyz 3. Check the output from memcached.

Actual results:

[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyzDEF

Expected results:

[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting' Deleting ABCDEF Deleting xyz

Additional info:

I've opened a bug report upstream: https://code.google.com/p/memcached/issues/detail?id=306

Latest version: 1.6.45

Latest version: 1.6.45

End of life: 3/9/2020, Latest version: 1.5.22

End of life: 3/9/2020, Latest version: 1.5.22

End of life: 7/21/2017, Latest version: 1.4.39

End of life: 7/21/2017, Latest version: 1.4.39

https://github.com/memcached/memcached/wiki/ReleaseNotes1642 reveals: Memcached 1.6.42 Release Notes

Date: 2026-5-18

Download -------- http://www.memcached.org/files/memcached-1.6.42.tar.gz

Overview -------- This is a major security focused release. Nearly all of the fixes are security related for issues that can cause memory corruption, crashes, and so on.

If you submitted a security report that ended up being value, you are credited in the commit history.

If you submitted a security report and do not see it here, it was either not a security bug or I missed it.

Due to the very high volume of security reports in this round I did not give them the individual scrutiny that I typically do: if there was a clear bug, it was fixed, but no effort was made to validate the potential impact of the bug.

Most of the these bugs look extremely obscure, and are impossible to trigger without convoluted configurations. This does not apply to all of the bugs: if memcached can be accessed easily by an attacker it can be crashed.

Similarly I have not created CVE's for any of these as that requires understanding the severity of each bug. In most cases these submissions vastly overstated the severity of the bug. I leave it up to the submitters to request their own CVE's if they wish.

Upgrading is strongly advised, regardless. Thanks to everyone who submitted reports and for your patience in allowing me to collect the fixes all at once.

Fixes ----- - vendor: Instructively warn if vendor blob missing - proxy: fix write length in extstore miss - Fix timing side-channel in SASL password database authentication - proto: fix signed overflow in bodylen for binprot - proxy: fix underflow with 0 length values - auth: fix data race during reload - auth: fix crash when given huge token - proto: fix crash in binary protocol - core: fix crashes from slabs reassign - proxy: check result of buffer parse in matchres - proxy: fix memory underread when nulling requests - update data block protocol description to no longer reference obsolete S flag

New Features ------------ None.

Contributors ------------ The following people contributed to this release since 1.6.41.

Note that this is based on who contributed changes, not how they were done. In many cases, a code snippet on the mailing list or a bug report ended up as a commit with your name on it.

Note that this is just a summary of how many changes each person made which doesn't necessarily reflect how significant each change was. For details on what led up into a branch, either grab the git repo and look at the output of git log 1.6.41..1.6.42 or use a web view.

- Repo list: https://github.com/memcached/memcached/wiki/DevelopmentRepos - Web View: http://github.com/memcached/memcached/commits/1.6.42

8 dormando 2 Bujna, Igor 1 Alec Stewart 1 Sarthak Munshi