CVE catalog

CVE-2019-11596

memcached: CVE-2019-11596

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
2.96% · Oct 25, 2026

In memcached before 1.5.14, a NULL pointer dereference was found in the "lru mode" and "lru temp_ttl" commands. This causes a denial of service when parsing crafted lru command messages in process_lru_command in memcached.c.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmemcachedsid1.6.45-1fixed
Debianmemcachedforky1.6.45-1fixed
Debianmemcachedtrixie1.6.38-1fixed
Debianmemcachedbookworm1.6.18-1fixed
Debianmemcachedbookworm-security1.6.18-1+deb12u1fixed
Ubuntumemcached18.041.4.33-1ubuntu3vulnerable
Ubuntumemcached18.041.5.4-1ubuntu2vulnerable
Ubuntumemcached18.041.5.4-1ubuntu3vulnerable
Ubuntumemcached18.041.5.6-0ubuntu1vulnerable
Ubuntumemcached18.041.5.6-0ubuntu1.1fixed
Ubuntumemcached18.041.4.33-1ubuntu3vulnerable
Ubuntumemcached18.041.5.4-1ubuntu2vulnerable
Ubuntumemcached18.041.5.4-1ubuntu3vulnerable
Ubuntumemcached18.041.5.6-0ubuntu1vulnerable
Ubuntumemcached18.041.5.6-0ubuntu1.1fixed
Opensusememcachedleap 15.11.5.6-lp151.4.3.1fixed
Susememcachedlinux enterprise module for server applications 15 sp11.5.6-4.5.30fixed
Susememcachedlinux enterprise software development kit 12 sp41.4.39-4.11.2fixed
Susememcachedlinux enterprise software development kit 12 sp51.4.39-4.11.2fixed
Susememcachedlinux enterprise server 12 sp41.4.39-4.11.2fixed
Susememcachedlinux enterprise server for sap applications 12 sp41.4.39-4.11.2fixed
Susememcachedlinux enterprise server 12 sp51.4.39-4.11.2fixed
Susememcachedlinux enterprise server for sap applications 12 sp51.4.39-4.11.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmemcachedsourcesid1.5.6-1.1not yet assignedNot reported[928205]
Debianmemcachedsourceforky1.5.6-1.1not yet assignedNot reported[928205]
Debianmemcachedsourcetrixie1.5.6-1.1not yet assignedNot reported[928205]
Debianmemcachedsourcebookworm1.5.6-1.1not yet assignedNot reported[928205]
Ubuntumemcacheddeb18.041.5.6-0ubuntu1.1Not reportedUSN-3963-1Not reported
Ubuntumemcacheddeb18.041.5.6-0ubuntu1.1Not reportedUBUNTU-CVE-2019-11596Not reported
Opensusememcachedrpmleap 15.11.5.6-lp151.4.3.1Not reportedOPENSUSE-SU-2020:0721-1Not reported
Susememcachedrpmlinux enterprise module for server applications 15 sp11.5.6-4.5.30Not reportedSUSE-SU-2020:1381-1Not reported
Susememcachedrpmlinux enterprise software development kit 12 sp41.4.39-4.11.2Not reportedSUSE-SU-2020:0843-1Not reported
Susememcachedrpmlinux enterprise software development kit 12 sp51.4.39-4.11.2Not reportedSUSE-SU-2020:0843-1Not reported
Susememcachedrpmlinux enterprise server 12 sp41.4.39-4.11.2Not reportedSUSE-SU-2020:0843-1Not reported
Susememcachedrpmlinux enterprise server for sap applications 12 sp41.4.39-4.11.2Not reportedSUSE-SU-2020:0843-1Not reported
Susememcachedrpmlinux enterprise server 12 sp51.4.39-4.11.2Not reportedSUSE-SU-2020:0843-1Not reported
Susememcachedrpmlinux enterprise server for sap applications 12 sp51.4.39-4.11.2Not reportedSUSE-SU-2020:0843-1Not reported

[Debian bug #928205]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [memcached]Fixed
    Details (2)

    • 1.6.18-1 · amd64 · bookworm

      Fixed · Fixed: 1.5.6-1.1

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

    • 1.6.18-1 · arm64 · bookworm

      Fixed · Fixed: 1.5.6-1.1

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

[Debian 13 (Trixie)]

  • [memcached]Fixed
    Details (2)

    • 1.6.38-1 · amd64 · trixie

      Fixed · Fixed: 1.5.6-1.1

      dsa · memcached · debian · 13

    • 1.6.38-1 · arm64 · trixie

      Fixed · Fixed: 1.5.6-1.1

      dsa · memcached · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]