{"id":"CVE-2018-1000127","aliases":["DEBIAN-CVE-2018-1000127","DLA-1329-1","DSA-4218-1","EUVD-2018-1850","GHSA-xfxv-84p3-w8rg","RHSA-2018:2290","UBUNTU-CVE-2018-1000127","USN-3601-1","openSUSE-SU-2024:11045-1"],"status":"published","title":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free...","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02265,"percentile":0.83144,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-667"],"published":"2018-03-13T00:00:00Z","modified":"2026-10-23T18:04:46Z","fixes":[{"ecosystem":"Debian:12","package":"memcached","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"memcached","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"memcached","fixed_in":["1.5.0-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"memcached","fixed_in":["1.4.13-0.2+deb7u4"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"memcached","fixed_in":["0:1.4.39-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"memcached-debuginfo","fixed_in":["0:1.4.39-2.el7ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"memcached","fixed_in":["1.4.14-0ubuntu9.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"memcached","fixed_in":["1.4.25-2ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.13-0.2+deb7u4"}]}],"versions":["1.4.13-0.2","1.4.13-0.2+deb7u1","1.4.13-0.2+deb7u2","1.4.13-0.2+deb7u3"]},{"source":"osv","ecosystem":"Debian:8","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.21-1.1+deb8u2"}]}],"versions":["1.4.21-1.1","1.4.21-1.1+deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.33-1+deb9u1"}]}],"versions":["1.4.33-1"],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.39-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"memcached-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.39-2.el7ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-0ubuntu9.3"}]}],"versions":["1.4.14-0ubuntu4","1.4.14-0ubuntu8","1.4.14-0ubuntu9","1.4.14-0ubuntu9.1","1.4.14-0ubuntu9.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.25-2ubuntu1.4"}]}],"versions":["1.4.24-2ubuntu1","1.4.25-1ubuntu2","1.4.25-2ubuntu1","1.4.25-2ubuntu1.2","1.4.25-2ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.14-0ubuntu9.3"}]}],"versions":["1.4.14-0ubuntu4","1.4.14-0ubuntu8","1.4.14-0ubuntu9","1.4.14-0ubuntu9.1","1.4.14-0ubuntu9.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.25-2ubuntu1.4"}]}],"versions":["1.4.24-2ubuntu1","1.4.25-1ubuntu2","1.4.25-2ubuntu1","1.4.25-2ubuntu1.2","1.4.25-2ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"memcached","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-2.3"}]}],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"memcached","product":"memcached"},{"vendor":"redhat","product":"openstack"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2290","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/03/msg00031.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://usn.ubuntu.com/3601-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4218","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/memcached/memcached/wiki/ReleaseNotes1437","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://github.com/memcached/memcached/issues/271","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000127","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xfxv-84p3-w8rg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000127","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1555064","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2290.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000127","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000127","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3601-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000127","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10931","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000127","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2018-03-13T21:00:00Z","modified":"2024-08-05T12:33:49.281Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1850","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2018-03-13T21:00:00Z","modified":"2024-08-05T12:33:49Z","updated_at":"2026-11-03T02:39:26.824954Z"}],"ghsa":[{"id":"GHSA-xfxv-84p3-w8rg","title":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free...","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2022-05-13T01:18:44Z","modified":"2023-02-01T05:05:33Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:50:15.334804Z"}],"nvd":[{"id":"CVE-2018-1000127","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2018-03-13T21:29:00.477Z","modified":"2026-06-17T01:32:29.25Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190","CWE-667"],"updated_at":"2026-11-02T14:04:24.264003Z"}],"osv":[{"id":"CVE-2018-1000127","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2018-03-13T21:29:00.477Z","modified":"2026-10-20T13:25:24.037313119Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000127","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2018-03-13T21:29:00.477Z","modified":"2026-10-23T18:04:46.438284878Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:2290","title":"Red Hat Security Advisory: memcached security update","status":"published","published":"2024-09-13T16:51:46Z","modified":"2026-06-29T10:21:33Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-1000127","description":"memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.","status":"published","published":"2018-03-13T00:00:00Z","modified":"2026-02-04T02:31:00.341845Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1329-1","title":"memcached - security update","status":"published","published":"2018-03-29T00:00:00Z","modified":"2026-03-09T01:01:22.308692Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4218-1","title":"memcached - security update","status":"published","published":"2018-06-06T00:00:00Z","modified":"2026-03-09T01:22:54.032128Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2024:11045-1","title":"memcached-1.6.9-2.3 on GA media","description":"These are all security issues fixed in the memcached-1.6.9-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:06.262209Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"USN-3601-1","title":"memcached vulnerability","description":"It was discovered that Memcached incorrectly handled reusing certain items.\nA remote attacker could possibly use this issue to cause Memcached to\ncrash, resulting in a denial of service.\n","status":"published","published":"2018-03-19T18:53:06Z","modified":"2026-02-10T04:41:17Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}