CVE-2026-90698: memcached Out-of-Bounds Read Vulnerability

CVE-2026-90698 Overview

CVE-2026-90698 is an out-of-bounds read vulnerability in memcached versions 1.6.41, 1.6.42, and 1.6.43. The flaw resides in the try_read_command_asciiauth function within proto_text.c, which is part of the mcmc tokenizer component. An attacker can trigger the condition remotely by sending crafted input containing empty newlines when authentication is enabled. The result is a crash of the memcached process, producing a denial-of-service condition. Public exploit code has been released. Upgrading to memcached 1.6.44 resolves the issue via commit af05c9302bba508b736c3da1d5670f63fe8b7db4.

Critical Impact
Remote unauthenticated attackers can crash memcached instances that have ASCII authentication enabled by sending empty newline sequences, disrupting caching services and any application relying on them.

Affected Products

memcached 1.6.41
memcached 1.6.42
memcached 1.6.43

Discovery Timeline

2026-09-14 - CVE-2026-90698 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90698

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-119] in the ASCII authentication code path of memcached. When ASCII auth is enabled, memcached processes credentials through try_read_command_asciiauth in proto_text.c. The function invokes the mcmc tokenizer to parse the incoming request. Supplying an empty line or an under-sized request causes the tokenizer to read past the intended buffer boundary. The resulting memory access crashes the daemon and terminates active client sessions. Because memcached commonly runs as a shared caching tier, a crash cascades into performance degradation or outages for dependent applications.

Root Cause

The function did not enforce a minimum request length before dispatching parsing logic. The patch introduces a new constant, MIN_AUTH_REQ_LEN 6, alongside the existing MAX_AUTH_REQ_LEN 16384. Requests shorter than the minimum are now rejected before the tokenizer is invoked, preventing the out-of-bounds access.

Attack Vector

Exploitation requires network access to a memcached instance running an affected version with ASCII authentication enabled. No credentials or user interaction are required. The attacker sends an authentication request consisting of an empty newline, which drives the tokenizer into the vulnerable code path and crashes the process.

 #define SUBCOMMAND_TOKEN 1
 #define KEY_TOKEN 1
 #define MAX_AUTH_REQ_LEN 16384
+#define MIN_AUTH_REQ_LEN 6
 
 int try_read_command_asciiauth(conn *c) {
     mcmc_tokenizer_t tok;

Source: GitHub Commit af05c93

The upstream regression test was also updated to reflect the corrected behavior for oversized-length authentication requests:

text

 like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to authenticate");
 
 # Super long tokens are invalid.
-print $sock "set foo 0 0 2147483646\r\nasfd\r\n";
+print $sock "set foo 0 0 2147483646\r\n";
 like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to authenticate");

Source: GitHub Commit af05c93

Detection Methods for CVE-2026-90698

Indicators of Compromise

Unexpected termination or repeated restarts of the memcached service on instances running 1.6.41, 1.6.42, or 1.6.43.
Client CLIENT_ERROR responses followed by dropped TCP connections on the memcached listener port (default 11211).
Inbound connections issuing empty CRLF sequences immediately after connect against memcached endpoints with -Y (ASCII auth) enabled.

Detection Strategies

Monitor process supervisors (systemd, container orchestrators) for crash-loop events on the memcached binary.
Inspect network traffic to port 11211 for authentication attempts containing only line terminators or malformed short frames.
Correlate application-side cache errors and latency spikes with memcached restart timestamps.

Monitoring Recommendations

Ship memcached stderr and supervisor logs to a centralized logging or SIEM platform and alert on abnormal restart frequency.
Enable network flow logging for cache-tier subnets to identify anomalous connection sources probing the auth interface.
Track the installed memcached version across the fleet using configuration management or software inventory tooling.

How to Mitigate CVE-2026-90698

Immediate Actions Required

Upgrade all memcached deployments to version 1.6.44 or later.
Restrict network access to memcached instances so that only trusted application hosts can reach port 11211.
Audit whether ASCII authentication (-Y / authfile) is enabled and confirm exposure scope.

Patch Information

The fix is available in memcached 1.6.44 and is tracked in commit af05c9302bba508b736c3da1d5670f63fe8b7db4. See the GitHub Release 1.6.44 notes and the Protectiv Research Analysis for full technical background. Additional references are available at VulDB CVE-2026-90698.

Workarounds

Place memcached behind a firewall or security group that allows connections only from authorized application servers.
Disable ASCII authentication if it is not required; the vulnerable path is reached only when -Y is active.
Bind memcached to loopback or a private interface using -l 127.0.0.1 where remote access is unnecessary.

bash

# Upgrade example on Debian/Ubuntu-based systems
sudo apt-get update
sudo apt-get install --only-upgrade memcached
memcached -V   # Verify version reports 1.6.44 or later
sudo systemctl restart memcached