CVE-2026-90698

Publication date 14 September 2026

Last updated 24 September 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

5.3 · Medium

Score breakdown

Description

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component.

Read the notes from the security team

Status

Package Ubuntu Release Status
memcached 26.04 LTS resolute
Fixed 1.6.40-1ubuntu0.3
24.04 LTS noble
Fixed 1.6.24-1ubuntu0.3
22.04 LTS jammy
Fixed 1.6.14-1ubuntu0.3
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial
Not affected

Notes

mdeslaur

The patched code exists in versions older than 1.6.41, but is probably not exploitable. The following commits likely introduced the issue: https://github.com/memcached/memcached/commit/778cfd6e56a276f69bdd1c4c7725c977147aee47 https://github.com/memcached/memcached/commit/591fba966837b2f3398ccf7b5fe3886ac19e9e20 Based on this, the USN was likely unnecessary. I am marking the remaining releases as not-affected.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
memcached

Severity score breakdown

CVSS version:

Base score 5.5 · Medium

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

Base score 5.3 · Medium

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

Related Ubuntu Security Notices (USN)

    • USN-8792-1
    • Memcached vulnerability
    • 21 September 2026

Other references

Access our resources on patching vulnerabilities