The try_read_command function in memcached.c in memcached before 1.4.39 allows remote attackers to cause a denial of service (segmentation fault) via a request to add/set a key, which makes a comparison between signed and unsigned int and triggers a heap-based buffer over-read. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-8705.
CVSS Details
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-memcached | Sep 20, 2017 | Jul 17, 2017 | |
| Debian | debian-upgrade-memcached | Jun 7, 2018 | Jul 17, 2017 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-memcached | Dec 4, 2019 | Jul 17, 2017 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-memcached | Dec 18, 2019 | Jul 17, 2017 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-memcached | Nov 19, 2019 | Jul 17, 2017 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-service-memcached-1-5-11-11-4-5-0-1-2-0 | Feb 20, 2019 | Jul 17, 2017 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Jul 17, 2017 |
| Suse | — | suse-upgrade-memcachedsuse-upgrade-memcached-devel | Mar 30, 2018 | Jul 17, 2017 |
| Ubuntu | ubuntu-upgrade-memcached | Mar 6, 2018 | Jul 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub