CVE-2026-90698
Received Received - Intake

Out-of-Bounds Read in Memcached mcmc Tokenizer

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90698
EUVD
EUVD-2026-77330

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
memcached memcached 1.6.41
memcached memcached 1.6.42
memcached memcached 1.6.43
memcached memcached 1.6.44
memcached memcached From 1.6.44 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a pre-authentication remote denial-of-service (DoS) vulnerability in memcached versions 1.6.41 through 1.6.43 when ASCII authentication is enabled using the -Y flag. An attacker can crash the memcached process by sending three consecutive newline bytes immediately after connecting, causing a segmentation fault. The issue stems from improper validation of token length in the authentication handling code, leading to an out-of-bounds read.

Detection Guidance

To detect this vulnerability, check if your memcached instance is running version 1.6.41, 1.6.42, or 1.6.43 with ASCII authentication enabled (started with the -Y flag). Use commands like 'memcached -h' to check the version and 'ps aux | grep memcached' to verify if -Y is used.

Impact Analysis

An attacker can repeatedly crash the memcached service, disrupting cache availability and forcing repeated cold-start recovery if the service is supervised and restarted. This can lead to degraded performance, service unavailability, and increased operational overhead for maintaining service uptime.

Compliance Impact

This vulnerability primarily causes denial-of-service (DoS) conditions by crashing memcached instances, which could disrupt data availability. For GDPR, this may impact the integrity and availability of personal data processing systems. HIPAA requires availability of ePHI; a DoS could violate this requirement. However, the CVE itself does not directly reference compliance standards.

Mitigation Strategies

Immediately upgrade memcached to version 1.6.44 or later. If upgrading is not possible, disable ASCII authentication by removing the -Y flag from the memcached startup command. Ensure the service is restarted after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart