Vulnerability record · CVE-2016-8706 · published 6 January 2017
CVE-2016-8706: Memcached binary protocol SASL auth integer overflow leads to RCE
MMemcached · Memcached
An integer overflow in the process_bin_sasl_auth function, which handles authentication commands in the Memcached binary protocol, can cause a heap overflow. Successful abuse can lead to remote code execution on the Memcached server.
Description
An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abused to cause heap overflow and lead to remote code execution.
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.1 with remote code execution potential and a very high EPSS percentile, though no KEV listing or confirmed in-the-wild exploitation is documented.
What it is
An integer overflow in the process_bin_sasl_auth function, which handles authentication commands in the Memcached binary protocol, can cause a heap overflow. Successful abuse can lead to remote code execution on the Memcached server.
Impact
An attacker can corrupt heap memory and potentially execute arbitrary code on the affected Memcached process, gaining control of the service and any data or host access it holds.
Attack surface
Reachable over the network via the Memcached binary protocol SASL authentication path; the CVSS vector indicates no privileges and no user interaction are required, though attack complexity is rated high.
Exploitation
Not listed in CISA KEV and no ransomware association is documented; EPSS is 0.45703 (98.7th percentile), and the Talos reference is tagged Exploit and Technical Description, indicating public exploit detail exists.
What to do
- Upgrade Memcached to a version containing the fix referenced by the Red Hat, Debian and Gentoo advisories.
- Disable or restrict the binary protocol and SASL authentication if not required.
- Bind Memcached to trusted interfaces only and block external access to its ports.
- Apply vendor patches from RHSA-2016-2819, DSA-3704 and GLSA 201701-12 as applicable.
Detection
- Monitor Memcached logs and network traffic for malformed or unusual binary protocol SASL authentication commands.
- Watch for crashes or abnormal process termination of memcached that could indicate heap corruption attempts.
- Alert on unexpected outbound connections or child processes spawned by the memcached service.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://rhn.redhat.com/errata/RHSA-2016-2819.html | |
| http://www.debian.org/security/2016/dsa-3704 | |
| http://www.securityfocus.com/bid/94083 | |
| http://www.securitytracker.com/id/1037333 | |
| http://www.talosintelligence.com/reports/TALOS-2016-0221/ | ExploitTechnical DescriptionThird Party AdvisoryVDB Entry |
| https://security.gentoo.org/glsa/201701-12 | |
| http://rhn.redhat.com/errata/RHSA-2016-2819.html | |
| http://www.debian.org/security/2016/dsa-3704 | |
| http://www.securityfocus.com/bid/94083 | |
| http://www.securitytracker.com/id/1037333 | |
| http://www.talosintelligence.com/reports/TALOS-2016-0221/ | ExploitTechnical DescriptionThird Party AdvisoryVDB Entry |
| https://security.gentoo.org/glsa/201701-12 |
Track CVE-2016-8706 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-8706), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
