CVE-2011-4971
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2)...
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
Exploit likelihood
What each source reports
NVD Score used
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
- Record
CVE-2011-4971- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
- Record
CVE-2011-4971- Updated
- 2026-11-02
EUVDEUVD-2011-4876 No score
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
- Record
EUVD-2011-4876- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pj3v-4mjw-vvpv No score
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2)...
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
- Record
GHSA-pj3v-4mjw-vvpv- Updated
- 2026-11-02
OSV No score
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
- Record
CVE-2011-4971- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4971 No score
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.
- Record
DEBIAN-CVE-2011-4971- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2013-0339 No score
Updated memcached packages fix CVE-2011-4971
Updated memcached packages fix security vulnerability:
Memcached is vulnerable to a denial of service as it can be made to crash when it receives a specially crafted packet over the network (CVE-2011-4971).
The updated packages have been upgraded to the 1.4.15 version and patched to resolve this flaw.
- Record
MGASA-2013-0339- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10021-1 No score
memcached-1.4.33-1.1 on GA media
These are all security issues fixed in the memcached-1.4.33-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10021-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0778-1 No score
Security update for memcached
This update for memcached fixes the following issues:
Security issues fixed:
- CVE-2011-4971: remote DoS (bsc#817781).
- CVE-2013-0179: DoS when printing out keys to be deleted in verbose mode (bsc#798458).
- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).
- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).
- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).
- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).
- CVE-2016-8705: Server update remote code execution (bsc#1007870).
- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).
- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).
- Record
SUSE-SU-2018:0778-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:0807-1 No score
Security update for memcached
This update for memcached fixes the following issues:
Security issues fixed:
- CVE-2011-4971: remote DoS (bsc#817781).
- CVE-2013-0179: DoS when printing out keys to be deleted in verbose mode (bsc#798458).
- CVE-2013-7239: SASL authentication allows wrong credentials to access memcache (bsc#857188).
- CVE-2013-7290: remote DoS (segmentation fault) via a request to delete a key (bsc#858677).
- CVE-2013-7291: remote DoS (crash) via a request that triggers 'unbounded key print' (bsc#858676).
- CVE-2016-8704: Server append/prepend remote code execution (bsc#1007871).
- CVE-2016-8705: Server update remote code execution (bsc#1007870).
- CVE-2016-8706: Server ASL authentication remote code execution (bsc#1007869).
- CVE-2017-9951: Heap-based buffer over-read in try_read_command function (incomplete fix for CVE-2016-8705) (bsc#1056865).
- Record
SUSE-SU-2018:0807-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
memcachedDebian:12 |
before 1.4.13-0.3 | 1.4.13-0.3 |
memcachedDebian:13 |
before 1.4.13-0.3 | 1.4.13-0.3 |
memcachedDebian:14 |
before 1.4.13-0.3 | 1.4.13-0.3 |
memcachedDebian:6.0 From an advisory covering 2 CVEs |
before 1.4.5-1+deb6u1, plus listed versions 1.4.5-1 |
1.4.5-1+deb6u1 |
memcachedDebian:7 From an advisory covering 2 CVEs |
before 1.4.13-0.2+deb7u1, plus listed versions 1.4.13-0.2 |
1.4.13-0.2+deb7u1 |
memcachedMageia:2 |
before 1.4.15-1.mga2 | 1.4.15-1.mga2 |
memcachedMageia:3 |
before 1.4.15-1.mga3 | 1.4.15-1.mga3 |
memcachedSUSE:OpenStack Cloud 7 From an advisory covering 9 CVEs |
before 1.4.39-3.3.2 | 1.4.39-3.3.2 |
memcachedSUSE:Enterprise Storage 4 From an advisory covering 9 CVEs |
before 1.4.39-3.3.2 | 1.4.39-3.3.2 |
memcachedSUSE:OpenStack Cloud 6 From an advisory covering 9 CVEs |
before 1.4.39-3.3.1 | 1.4.39-3.3.1 |
memcachedopenSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 1.4.33-1.1 | 1.4.33-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Memcached Remote Denial of Service |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Metasploit, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4971 is a medium vulnerability (CVSS 5.0) in Memcached, published November 22, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 22.3%, the 97th percentile. Fixed in memcached 1.4.13-0.3.
References
insecurety.net?p=872
mandriva.com/security/advisories?name=MDVSA-2013:280
code.google.com/p/memcached/issues/detail?id=192
ubuntu.com/usn/USN-2080-1
securityfocus.com/bid/59567
puppet.com/security/cve/cve-2011-4971
Show 30 moreShow less
debian.org/security/2014/dsa-2832
secunia.com/advisories/56183
nvd.nist.gov/vuln/detail/CVE-2011-4971
github.com/advisories/GHSA-pj3v-4mjw-vvpv
security-tracker.debian.org/tracker/CVE-2011-4971
advisories.mageia.org/MGASA-2013-0339.html
openwall.com/lists/oss-security/2013/04/30/3
bugzilla.redhat.com/show_bug.cgi?id=957964
bugs.mageia.org/show_bug.cgi?id=9928
suse.com/support/update/announcement/2018/suse-su-20180778-1
bugzilla.suse.com/1007869