Ubuntu USN-8792-1 Fixes Memcached Vulnerability
Tech GuruQuick Answer
Ubuntu's USN-8792-1 fixes CVE-2026-90698 in Memcached on jammy, noble, and resolute. Incorrect handling of ASCII authentication can let a remote attacker crash the service. Apply the package for the host's Ubuntu release and check the applications that depend on the cache.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory Memcached instances and their Ubuntu releases, identify exposed client connections, install the corresponding fixed package, and verify cache availability for dependent applications.
Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Memcached vulnerability on Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy) |
|---|---|
| Advisory | USN-8792-1 |
| CVE | CVE-2026-90698 |
| Authoritative release date | 2026-09-21 13:02:27.327801 UTC |
| Authority revision date | 2026-09-21 13:02:27.327801 UTC |
| Affected versions | The Ubuntu releases and packages enumerated in USN-8792-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy). |
| Fixed version | jammy: memcached 1.6.14-1ubuntu0.3 / noble: memcached 1.6.24-1ubuntu0.3 / resolute: memcached 1.6.40-1ubuntu0.3 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The issue is denial of service in Memcached's ASCII-authentication handling. Ubuntu does not describe an authentication bypass or code-execution outcome here. Its instructions say a standard system update generally makes the necessary changes; follow the package's supported activation requirements.
What To Validate Now
- Inventory. Record each Memcached instance's release, package version, listening interfaces, permitted clients, and application owner.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The Ubuntu releases and packages enumerated in USN-8792-1: Ubuntu 26.04 LTS (resolute), Ubuntu 24.04 LTS (noble), Ubuntu 22.04 LTS (jammy). Do not infer applicability from product family or severity alone.
- Remediate. Apply jammy: memcached 1.6.14-1ubuntu0.3 / noble: memcached 1.6.24-1ubuntu0.3 / resolute: memcached 1.6.40-1ubuntu0.3 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. Confirm the fixed package and active service, then test approved client connections and normal cache reads/writes. Check dependent application errors and latency during the maintenance window.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
