Read the docs
TI-2026-61655 Aliases CVE-2026-90698GHSA-xf89-37qr-gchh

memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds

Priority HIGH 70CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00859 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed memcached: 1.6.44Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—memcached1.6.41; 1.6.42; 1.6.431.6.44Patch availableCNA
  • memcached Vendor— Affected 1.6.41; 1.6.42; 1.6.43 Fixed in 1.6.44 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:*——Memcached
  • cpe:2.3:a:memcached:memcached:*:*:*:*:*:*:*:* Versions — — ·Memcached

Remediation

  • Fix · CNA memcached Fixed in 1.6.44

Red Hat 1 advisory

  • RHSA-2026:63224 Released 2026-09-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images memcached-1.6.45-1.hum1@aarch64, memcached-1.6.45-1.hum1@src, memcached-1.6.45-1.hum1@x86_64 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Hardened ImagesFixed RHSA-2026:63224
Not affected: 6 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenStack Platform 13 (Queens)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-90698
  2. 2026-10-03 Alias added: GHSA-xf89-37qr-gchh

References

Exploit 1

Patch 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences