CVE catalog

CVE-2016-8705

memcached: CVE-2016-8705

[CVE catalog]

Severity
Critical · CVSS 9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
19.85% · Oct 25, 2026

Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmemcachedsid1.6.45-1fixed
Debianmemcachedforky1.6.45-1fixed
Debianmemcachedtrixie1.6.38-1fixed
Debianmemcachedbookworm1.6.18-1fixed
Debianmemcachedbookworm-security1.6.18-1+deb12u1fixed
Alpinememcached3.41.4.33-r0fixed
Alpinememcached3.51.4.33-r0fixed
Ubuntumemcached14.041.4.14-0ubuntu4vulnerable
Ubuntumemcached14.041.4.14-0ubuntu8vulnerable
Ubuntumemcached14.041.4.14-0ubuntu9vulnerable
Ubuntumemcached14.041.4.14-0ubuntu9.1fixed
Ubuntumemcached16.041.4.24-2ubuntu1vulnerable
Ubuntumemcached16.041.4.25-1ubuntu2vulnerable
Ubuntumemcached16.041.4.25-2ubuntu1vulnerable
Ubuntumemcached16.041.4.25-2ubuntu1.2fixed
Susememcachedlinux enterprise software development kit 11 sp41.2.6-5.17.4.1fixed
Susememcachedstudio onsite 1.31.2.6-5.17.4.1fixed
Susememcachedstudio onsite runner 1.31.2.6-5.17.4.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmemcachedsourcesid1.4.33-1not yet assignedNot reported[842812]
Debianmemcachedsourceforky1.4.33-1not yet assignedNot reported[842812]
Debianmemcachedsourcetrixie1.4.33-1not yet assignedNot reported[842812]
Debianmemcachedsourcebookworm1.4.33-1not yet assignedNot reported[842812]
Alpinememcachedapk3.41.4.33-r0Not reportedALPINE-CVE-2016-8705Not reported
Alpinememcachedapk3.51.4.33-r0Not reportedALPINE-CVE-2016-8705Not reported
Ubuntumemcacheddeb14.041.4.14-0ubuntu9.1Not reportedUBUNTU-CVE-2016-8705Not reported
Ubuntumemcacheddeb16.041.4.25-2ubuntu1.2Not reportedUBUNTU-CVE-2016-8705Not reported
Susememcachedrpmlinux enterprise software development kit 11 sp41.2.6-5.17.4.1Not reportedSUSE-SU-2018:1601-1Not reported
Susememcachedrpmstudio onsite 1.31.2.6-5.17.4.1Not reportedSUSE-SU-2018:1601-1Not reported
Susememcachedrpmstudio onsite runner 1.31.2.6-5.17.4.1Not reportedSUSE-SU-2018:1601-1Not reported

[Debian bug #842812]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [memcached]Fixed
    Details (2)

    • 1.6.18-1 · amd64 · bookworm

      Fixed · Fixed: 1.4.33-1

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

    • 1.6.18-1 · arm64 · bookworm

      Fixed · Fixed: 1.4.33-1

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

[Debian 13 (Trixie)]

  • [memcached]Fixed
    Details (2)

    • 1.6.38-1 · amd64 · trixie

      Fixed · Fixed: 1.4.33-1

      dsa · memcached · debian · 13

    • 1.6.38-1 · arm64 · trixie

      Fixed · Fixed: 1.4.33-1

      dsa · memcached · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]