Update of the in-memory data caching system , which addresses , allowing the initiation of a process crash through the submission of specially crafted requests. The vulnerability has been present since version 1.6.0. As a workaround for protection, it is advisable to disable the binary protocol for external requests by starting with the option "-B ascii."
The issue is caused by a bug in the binary protocol header parsing, related to the incorrect determination of the size of the data being copied to the buffer during the memcpy function call (the size is determined based on the parameter specified in the request header). By manipulating the value of the parameter in the binary protocol header, an attacker with the ability to connect to the Memcached network port can trigger a buffer overflow, leading to a process crash.
Source: opennet.ru
