CVE-2026-90698 Details
Description
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.
A remote out-of-bounds read vulnerability has been identified in Memcached versions 1.6.41 through 1.6.43. This issue arises in the 'try_read_command_asciiauth' function within 'proto_text.c', part of the 'mcmc' tokenizer component. When Memcached is started with ASCII authentication enabled, an unauthenticated client can exploit this vulnerability by sending three newline characters immediately after establishing a connection. The exploitation triggers a read of an invalid memory area, causing a crash. This vulnerability has been publicly disclosed and is being actively exploited.
Upgrade Memcached to version 1.6.44, which addresses the vulnerability by adding proper checks to the authentication command processing function.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/memcached/memcached/ | [email protected] | Vendor |
| https://github.com/memcached/memcached/commit/af05c9302bba508b736c3da1d5670f63fe8b7db4 | [email protected] | Source CodeVendor |
| https://github.com/memcached/memcached/releases/tag/1.6.44 | [email protected] | Release NotesVendor |
| https://protectiv.ph/research/memcached-asciiauth-empty-line-dos | [email protected] | ExploitRemedyTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-90698 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/916217 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/submit/916219 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/403231 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/403231/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| memcached | >= 1.6.41, <= 1.6.43 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |