CVE-2026-90698: 
Memcached vulnerability analysis and mitigation

CVE-2026-90698 is an out-of-bounds read vulnerability in memcached affecting versions 1.6.41, 1.6.42, and 1.6.43. The flaw resides in the try_read_command_asciiauth function within proto_text.c, specifically in the mcmc Tokenizer component, and is triggered when ASCII authentication is enabled and empty newlines are sent to the service. It was disclosed on September 14, 2026, with a patch available in version 1.6.44. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, Memcached Commit).

The root cause is an improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-125). When memcached is started with ASCII authentication enabled (-Y flag), the try_read_command_asciiauth function in proto_text.c passes input to the mcmc tokenizer without first validating that the input string meets a minimum length requirement. Sending a series of empty newlines causes the tokenizer to attempt to read a string shorter than 2 characters, triggering an out-of-bounds read. The fix adds a MIN_AUTH_REQ_LEN check (set to 6) before tokenizer processing, closing the connection if the request is too short (Memcached Commit). The vulnerability was reported by Christian Angel of protectiv.ph, who also published a research write-up (Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to crash the memcached service by triggering an out-of-bounds memory read, resulting in a Denial of Service (DoS). The impact is limited to availability — there is no evidence of confidentiality or integrity compromise. Affected deployments are those running memcached with ASCII authentication enabled (-Y flag) on versions 1.6.41–1.6.43; standard deployments without auth enabled are not affected by this specific code path (Github Advisory, Memcached Commit).

The exploit has been publicly released and is referenced in the advisory, though no specific exploit kit or weaponized tool has been identified. The EPSS score is approximately 0.496%, indicating a low but non-negligible probability of exploitation in the wild. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated as Proof-of-Concept (Github Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible memcached instances running versions 1.6.41, 1.6.42, or 1.6.43 with ASCII authentication enabled (started with the -Y flag), using tools like Shodan or Censys targeting port 11211.
2. Connect to the target: Establish a TCP connection to the memcached service on port 11211 (e.g., using nc or a custom script).
3. Send empty newlines: Transmit a series of empty newline sequences (\r\n) to the service. With ASCII auth enabled, these are routed to the try_read_command_asciiauth function.
4. Trigger out-of-bounds read: The tokenizer receives a string shorter than the minimum required length (6 bytes), causing an out-of-bounds memory read and crashing the memcached process.
5. Result: The memcached service becomes unavailable, causing a Denial of Service for all dependent applications (Memcached Commit, Github Advisory).

• Network: Repeated TCP connections to memcached port 11211 from unexpected or external IP addresses; connections sending only \r\n sequences with no valid command payload.
• Logs: Memcached process crash logs or unexpected restarts in system logs (e.g., syslog, journald); error messages related to connection handling in memcached debug output.
• Process: Unexpected termination or restart of the memcached process; monitoring tools (e.g., systemd, supervisor) reporting service restarts.

Upgrade memcached to version 1.6.44 or later, which includes the fix in commit af05c9302bba508b736c3da1d5670f63fe8b7db4 (Memcached Release). If immediate patching is not possible, restrict network access to the memcached service to trusted internal networks only using firewall rules, and avoid exposing port 11211 to untrusted networks. Additionally, if ASCII authentication (-Y flag) is not required, disabling it eliminates the vulnerable code path entirely.

The vulnerability was reported by Christian Angel of protectiv.ph, who published a research write-up at https://protectiv.ph/research/memcached-asciiauth-empty-line-dos (Github Advisory). Red Hat acknowledged the issue via their Bugzilla tracker. Community reaction has been limited given the moderate severity and narrow precondition (ASCII auth must be enabled), with no significant media coverage or widespread social media discussion observed.