Public Date:
1390511: CVE-2016-8705 memcached: Server update remote code execution
An integer overflow flaw, leading to a heap-based buffer overflow, was found in the memcached binary protocol. An attacker could create a specially crafted message that would cause the memcached server to crash or, potentially, execute arbitrary code.

Find out more about CVE-2016-8705 from the MITRE CVE dictionary dictionary and NIST NVD.


The versions of memcached as shipped with Red Hat OpenStack Platform 7, 8 and 9 are affected by this issue however will not be updated. The latest version of memcached from Red Hat Enterprise Linux 7 can safely be allowed to supersede the earlier versions provided in the Red Hat OpenStack Platform channels.

CVSS v2 metrics

Base Score 6.8
Base Metrics AV:N/AC:M/Au:N/C:P/I:P/A:P
Access Vector Network
Access Complexity Medium
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial

CVSS v3 metrics

CVSS3 Base Score 9.8
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact High

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Mobile Application Platform 4.2 (rhmap-fh-openshift-templates) RHSA-2017:0059 2017-01-11
Red Hat Enterprise Linux 7 (memcached) RHSA-2016:2819 2016-11-23
Red Hat Enterprise Linux 6 (memcached) RHSA-2016:2820 2016-11-23

Affected Packages State

Platform Package State
Red Hat OpenStack Platform 9.0 memcached Will not fix
Red Hat OpenStack Platform 8.0 (Liberty) memcached Will not fix
Red Hat OpenStack Platform 10 memcached Not affected
Red Hat Mobile Application Platform On-Premise 4 memcached Affected
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 memcached Will not fix


This flaw is in the memcached binary protocol. If your client programs only use the ASCII protocol when communicating with memcached, you can disable the binary protocol and protect against this flaw by adding "-B ascii" to OPTIONS in /etc/sysconfig/memcached.

External References

Last Modified