Skip to content
HackIndex logo

HackIndex

Memcached UDP Amplification Exposure

3 min read Mar 17, 2026

Memcached supports a UDP interface on port 11211 that is disabled by default in versions 1.5.6 and later but remains active on older deployments and some packaged installations. A Memcached instance that responds to UDP requests from arbitrary sources is both a data leakage risk and a well-documented amplification vector. UDP responses to a stats request can be hundreds of times larger than the request, making exposed instances attractive for abuse and a high-severity finding on internet-facing targets.

Check Whether UDP Port 11211 is Open

┌──(kali㉿kali)-[~]
└─$ nmap -sU -p 11211 $TARGET_IP 
PORT      STATE         SERVICE
11211/udp open|filtered memcache

Nmap often returns open|filtered for UDP because it cannot distinguish a filtered port from one that simply does not respond to empty probes. Send an actual Memcached command to get a definitive answer.

Send a UDP stats Request

The Memcached UDP protocol requires an 8-byte header prepended to the command. Use this one-liner to send a valid UDP stats request and capture the response:

┌──(kali㉿kali)-[~]
└─$ printf '\x00\x01\x00\x00\x00\x01\x00\x00stats\r\n' | nc -u -q2 $TARGET_IP 11211 
STAT pid 8821
STAT uptime 2913847
STAT curr_items 1204
END

A STAT response confirms the UDP interface is active and accepting unauthenticated requests. No response means UDP is disabled or filtered.

Confirm Amplification Factor

The amplification factor is the ratio of response size to request size. A stats request is around 15 bytes. The response can reach several kilobytes depending on how many statistics the instance returns. To measure it:

┌──(kali㉿kali)-[~]
└─$ printf '\x00\x01\x00\x00\x00\x01\x00\x00stats\r\n' | nc -u -q2 $TARGET_IP 11211 | wc -c

Any response larger than the 15-byte request confirms amplification potential. Responses above 1000 bytes represent significant amplification. On internet-facing instances this is a critical finding regardless of what data is exposed.

Check the Version for Default UDP Status

On Memcached 1.5.6 and later, UDP is disabled by default. If the version is below 1.5.6, UDP is on by default unless explicitly disabled. Retrieve the version over TCP first:

┌──(kali㉿kali)-[~]
└─$ echo -e "version\r" | nc -q2 $TARGET_IP 11211 
VERSION 1.4.25

A version below 1.5.6 on a network-exposed instance should be treated as UDP-enabled until proven otherwise.

Document the Finding

Record whether UDP port 11211 responds to unauthenticated requests, the Memcached version, and whether the instance is internet-facing or internal. An internet-facing UDP-enabled instance is a critical misconfiguration. An internal one is lower severity but still exposes cache data over an unmonitored channel.

References