CVE catalog

CVE-2018-1000115

memcached affected and fixed versions

[CVE catalog]

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
88.11% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiememcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debiantrixiememcached1.6.38-1Fixed[CVE-2018-1000115]
Debiansidmemcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debiansidmemcached1.6.45-1Fixed[CVE-2018-1000115]
Debianforkymemcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debianforkymemcached1.6.45-1Fixed[CVE-2018-1000115]
Debianbookworm-securitymemcached1.6.18-1+deb12u1Fixed[CVE-2018-1000115]
Debianbookwormmemcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debianbookwormmemcached1.6.18-1Fixed[CVE-2018-1000115]

Showing 9 fix observations. All 30 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Alpine3.4memcached1.4.33-r2UnknownSource applicability is not established[ALPINE-CVE-2018-1000115]
Alpine3.5memcached1.4.33-r2UnknownSource applicability is not established[ALPINE-CVE-2018-1000115]
Alpine3.6memcached1.4.36-r2UnknownSource applicability is not established[ALPINE-CVE-2018-1000115]
Debianbookwormmemcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debianbookwormmemcached1.6.18-1Fixed[CVE-2018-1000115]
Debianbookworm-securitymemcached1.6.18-1+deb12u1Fixed[CVE-2018-1000115]
Debianforkymemcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debianforkymemcached1.6.45-1Fixed[CVE-2018-1000115]
Debiansidmemcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debiansidmemcached1.6.45-1Fixed[CVE-2018-1000115]
Debiantrixiememcached1.5.6-1FixedDistribution-reported fixed boundary[CVE-2018-1000115]
Debiantrixiememcached1.6.38-1Fixed[CVE-2018-1000115]
Suselinux enterprise server 12 sp3memcached1.4.39-4.6.1UnknownSource applicability is not established[SUSE-SU-2018:0955-1]
Suselinux enterprise server for sap applications 12 sp3memcached1.4.39-4.6.1UnknownSource applicability is not established[SUSE-SU-2018:0955-1]
Suselinux enterprise software development kit 11 sp4memcached1.2.6-5.17.3.1UnknownSource applicability is not established[SUSE-SU-2018:1326-1]
Suseopenstack cloud 6crowbar-openstack3.0+git.1521471181.2b39130da-39.10.1UnknownSource applicability is not established[SUSE-SU-2018:1103-1]
Suseopenstack cloud 7crowbar-ha4.0+git.1521473535.67d2302-4.28.1UnknownSource applicability is not established[SUSE-RU-2018:1071-1]
Suseopenstack cloud 7crowbar-openstack4.0+git.1522325467.43e431f91-9.30.1UnknownSource applicability is not established[SUSE-RU-2018:1071-1]
Susestudio onsite 1.3memcached1.2.6-5.17.3.1UnknownSource applicability is not established[SUSE-SU-2018:1326-1]
Susestudio onsite runner 1.3memcached1.2.6-5.17.3.1UnknownSource applicability is not established[SUSE-SU-2018:1326-1]
Ubuntu14.04memcached1.4.14-0ubuntu4UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu14.04memcached1.4.14-0ubuntu8UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu14.04memcached1.4.14-0ubuntu9UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu14.04memcached1.4.14-0ubuntu9.1UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu14.04memcached1.4.14-0ubuntu9.2UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu16.04memcached1.4.24-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu16.04memcached1.4.25-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu16.04memcached1.4.25-2ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu16.04memcached1.4.25-2ubuntu1.2UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Ubuntu16.04memcached1.4.25-2ubuntu1.3UnknownSource applicability is not established[UBUNTU-CVE-2018-1000115]
Original provider fields
{
  "package_releases": [
    {
      "name": "memcached",
      "status": "fixed",
      "release": "sid",
      "version": "1.6.45-1"
    },
    {
      "name": "memcached",
      "status": "fixed",
      "release": "forky",
      "version": "1.6.45-1"
    },
    {
      "name": "memcached",
      "status": "fixed",
      "release": "trixie",
      "version": "1.6.38-1"
    },
    {
      "name": "memcached",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.6.18-1"
    },
    {
      "name": "memcached",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1.6.18-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "memcached",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.5.6-1"
    },
    {
      "bug": null,
      "name": "memcached",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.5.6-1"
    },
    {
      "bug": null,
      "name": "memcached",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.5.6-1"
    },
    {
      "bug": null,
      "name": "memcached",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.5.6-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "memcached",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.14-0ubuntu9.2"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "1.4.14-0ubuntu4",
        "1.4.14-0ubuntu8",
        "1.4.14-0ubuntu9",
        "1.4.14-0ubuntu9.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000115",
      "fixed_version": "1.4.14-0ubuntu9.2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2018-1000115",
      "provider_updated_at": "2026-02-04T04:40:45.141445Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.25-2ubuntu1.3"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.4.24-2ubuntu1",
        "1.4.25-1ubuntu2",
        "1.4.25-2ubuntu1",
        "1.4.25-2ubuntu1.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2018-1000115",
      "fixed_version": "1.4.25-2ubuntu1.3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2018-1000115",
      "provider_updated_at": "2026-02-04T04:40:45.141445Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.39-4.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server 12 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:0955-1",
      "fixed_version": "1.4.39-4.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:0955-1",
      "provider_updated_at": "2026-02-04T04:03:17.067980Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.39-4.6.1"
            }
          ]
        }
      ],
      "release": "linux enterprise server for sap applications 12 sp3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:0955-1",
      "fixed_version": "1.4.39-4.6.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:0955-1",
      "provider_updated_at": "2026-02-04T04:03:17.067980Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.6-5.17.3.1"
            }
          ]
        }
      ],
      "release": "linux enterprise software development kit 11 sp4",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:1326-1",
      "fixed_version": "1.2.6-5.17.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:1326-1",
      "provider_updated_at": "2026-02-04T04:00:01.447140Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.6-5.17.3.1"
            }
          ]
        }
      ],
      "release": "studio onsite 1.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:1326-1",
      "fixed_version": "1.2.6-5.17.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:1326-1",
      "provider_updated_at": "2026-02-04T04:00:01.447140Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.6-5.17.3.1"
            }
          ]
        }
      ],
      "release": "studio onsite runner 1.3",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:1326-1",
      "fixed_version": "1.2.6-5.17.3.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:1326-1",
      "provider_updated_at": "2026-02-04T04:00:01.447140Z",
      "applicability_unknown": true
    },
    {
      "name": "crowbar-openstack",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0+git.1521471181.2b39130da-39.10.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 6",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-SU-2018:1103-1",
      "fixed_version": "3.0+git.1521471181.2b39130da-39.10.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-SU-2018:1103-1",
      "provider_updated_at": "2026-02-04T03:59:49.529214Z",
      "applicability_unknown": true
    },
    {
      "name": "crowbar-ha",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0+git.1521473535.67d2302-4.28.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2018:1071-1",
      "fixed_version": "4.0+git.1521473535.67d2302-4.28.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2018:1071-1",
      "provider_updated_at": "2026-02-04T02:22:11.965947Z",
      "applicability_unknown": true
    },
    {
      "name": "crowbar-openstack",
      "distro": "suse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0+git.1522325467.43e431f91-9.30.1"
            }
          ]
        }
      ],
      "release": "openstack cloud 7",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/SUSE-RU-2018:1071-1",
      "fixed_version": "4.0+git.1522325467.43e431f91-9.30.1",
      "provider_source": "pypi",
      "provider_record_id": "SUSE-RU-2018:1071-1",
      "provider_updated_at": "2026-02-04T02:22:11.965947Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.33-r2"
            }
          ]
        }
      ],
      "release": "3.4",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2018-1000115",
      "fixed_version": "1.4.33-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2018-1000115",
      "provider_updated_at": "2026-10-23T17:23:29.162419141Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.33-r2"
            }
          ]
        }
      ],
      "release": "3.5",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2018-1000115",
      "fixed_version": "1.4.33-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2018-1000115",
      "provider_updated_at": "2026-10-23T17:23:29.162419141Z",
      "applicability_unknown": true
    },
    {
      "name": "memcached",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.36-r2"
            }
          ]
        }
      ],
      "release": "3.6",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2018-1000115",
      "fixed_version": "1.4.36-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2018-1000115",
      "provider_updated_at": "2026-10-23T17:23:29.162419141Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [memcached]Unknown
    Details (2)

    • 1.6.18-1 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

    • 1.6.18-1 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

[Debian 13 (Trixie)]

  • [memcached]Unknown
    Details (2)

    • 1.6.38-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · memcached · debian · 13

    • 1.6.38-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1

      dsa · memcached · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]