Description

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T09:17:02.300Z",
  "pubdate": "2026-09-14T09:17:02.300Z",
  "executiveSummary": "A critical out-of-bounds read vulnerability has been identified in the memcached caching system, specifically within the mcmc Tokenizer component. This flaw resides in the try_read_command_asciiauth function within proto_text.c, affecting versions 1.6.41, 1.6.42, and 1.6.43.\nThe vulnerability allows a remote, unauthenticated attacker to trigger an out-of-bounds read during the processing of ASCII-based authentication commands. This memory corruption issue poses significant security risks, potentially leading to information disclosure of sensitive process memory or causing a denial-of-service condition due to application instability or crashes.\nGiven that public exploit code is available for this vulnerability, the risk of exploitation by malicious actors is high. The flaw is exploitable remotely over the network, requiring no prior authentication. Organizations utilizing the affected versions of memcached should prioritize remediation efforts immediately to prevent unauthorized memory access or service disruptions. The vulnerability is fully resolved in version 1.6.44 via patch af05c9302bba508b736c3da1d5670f63fe8b7db4.",
  "technicalDetails": "The vulnerability is situated within the mcmc Tokenizer logic of memcached, specifically in the try_read_command_asciiauth function located in proto_text.c. The root cause pertains to improper boundary validation during the parsing of ASCII authentication sequences. When the function receives a crafted request, it fails to correctly account for the input length or the state of the internal read buffer, leading the parser to read beyond the intended bounds of the allocated buffer.\nThe exploitation process involves sending a specially crafted sequence of bytes to the memcached server port. As the server processes the incoming command stream, the try_read_command_asciiauth function attempts to read parameters from the buffer. Because of the insufficient bounds checking, the pointer increment logic exceeds the allocated memory segment. This triggers an out-of-bounds read, allowing the server to process or return data stored adjacent to the buffer in heap memory.\nFrom an attack flow perspective, the remote actor establishes a network connection to the memcached service and transmits a maliciously structured command that triggers the vulnerable logic path. Since the code is executed upon the initial reception and tokenization of the command, the attacker does not need to have existing credentials to initiate the read operation. This behavior facilitates the potential leakage of sensitive information residing in adjacent memory, which might include authentication tokens, configuration data, or other cached items.\nThe impact is twofold. First, the memory leakage could be leveraged to bypass security mechanisms or gain insights into the server's internal state. Second, if the out-of-bounds read accesses unmapped memory regions or causes the memcached process to encounter invalid memory structures during its subsequent internal operations, it will likely lead to a segmentation fault, effectively crashing the service and resulting in a denial-of-service. The vulnerability is present in versions 1.6.41 through 1.6.43. The resolution requires applying the vendor-provided patch, identified as af05c9302bba508b736c3da1d5670f63fe8b7db4, or upgrading the entire memcached package to version 1.6.44."
}