CVE-2026-34502
Description
A flaw was found in the memcached client in the Apache Portable Runtime Utility (apr-util). A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service.
Statement
The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application — they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack.
Mitigation
Restrict network access for applications that use the `apr-util` memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
