PatchTheCVEmemcached vulnerabilities and fixes
Recent CVEs affecting memcached, with upgrade or downgrade steps. 7 tracked.
memcached has 7 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 5. Most recent: 2023-10-27. Highest priority: CVE-2022-26635 (score 69/100).
- CVE-2023-46853 CRITICAL 9.8 UPGRADE In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is
- CVE-2023-46852 HIGH 7.5 UPGRADE In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there
- CVE-2022-48571 HIGH 7.5 DOWNGRADE memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
- CVE-2022-26635 CRITICAL 9.8 UPGRADE PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF in
- CVE-2021-37519 MEDIUM 5.5 DOWNGRADE Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via
- CVE-2020-22570 HIGH 7.5 UPGRADE Memcached 1.6.0 before 1.6.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted
- CVE-2020-10931 HIGH 7.5 UPGRADE Memcached 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (daemon crash) via a crafted
FAQ
How do I fix memcached vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is memcached being exploited right now?
None of the tracked memcached CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which memcached CVE should I patch first?
CVE-2022-26635 currently ranks highest (69/100): PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF in.