CVE-2026-90698 in memcached
Summary
by MITRE • 09/14/2026
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
A critical out-of-bounds read vulnerability has been identified in memcached versions 1.6.41 through 1.6.43, specifically within the proto_text.c file affecting the mcmc Tokenizer component and its try_read_command_asciiauth function. This flaw arises from improper boundary checks during the parsing of ASCII protocol commands, allowing an attacker to read memory beyond the allocated buffer limits. The vulnerability is remotely exploitable, meaning that a remote adversary can trigger this condition without requiring prior authentication or local access to the target system. Given that exploit code has been publicly released, the risk level is elevated as malicious actors can readily leverage this flaw for unauthorized data extraction or further exploitation attempts against vulnerable memcached instances deployed in production environments.
The technical nature of this vulnerability aligns with CWE-125, which describes out-of-bounds read scenarios where software reads data past the end or before the beginning of the intended buffer. In the context of memcached, such a flaw can lead to information disclosure by leaking sensitive internal state, authentication tokens, or other cached data stored in adjacent memory locations. Furthermore, depending on how the leaked data is processed and whether it influences subsequent control flow, this could potentially facilitate more severe attacks including denial-of-service conditions through application crashes or segmentation faults. The presence of public exploit code significantly increases the likelihood of active exploitation in the wild, necessitating immediate remediation efforts to prevent unauthorized access or service disruption.
From a threat intelligence perspective, this vulnerability can be mapped to MITRE ATT&CK techniques related to initial access and discovery phases, particularly those involving network-based attacks against database services. Attackers may use this flaw as an entry point to gather reconnaissance data about the internal network topology or cached application secrets. The operational impact extends beyond mere confidentiality breaches; it compromises the integrity and availability of the caching layer, which is often a critical performance component in modern web architectures. If memcached is used for session storage or rate limiting mechanisms, compromising its memory safety could undermine these security controls entirely.
To mitigate this risk, organizations must upgrade their memcached installations to version 1.6.44 or later immediately. The fix is implemented via patch af05c9302bba508b736c3da1d5670f63fe8b7db4, which corrects the boundary validation logic within the try_read_command_asciiauth function to ensure that all read operations remain strictly within allocated buffer limits. Administrators should verify their current version and apply updates across all nodes in any memcached cluster to maintain consistent security posture. Additionally, it is advisable to review network access controls around memcached ports to restrict exposure only to trusted application servers, thereby reducing the attack surface even if similar vulnerabilities are discovered in future releases. Regular patch management cycles and monitoring for new exploit developments should be integrated into standard operational procedures to address such high-severity issues promptly.