CVE-2026-34502

A flaw was found in the memcached client in the Apache Portable Runtime Utility (apr-util). A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service.

The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application — they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Restrict network access for applications that use the apr-util memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect.