# Memcached UDP Amplification Exposure

- **URL:** https://hackindex.io/services/memcached/vulnerability-discovery/memcached-udp-amplification-exposure
- **Path:** Memcached > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/memcached/vulnerability-discovery.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

Memcached supports a UDP interface on port 11211 that is disabled by default in versions 1.5.6 and later but remains active on older deployments and some packaged installations. A Memcached instance that responds to UDP requests from arbitrary sources is both a data leakage risk and a well-documented amplification vector. UDP responses to a `stats` request can be hundreds of times larger than the request, making exposed instances attractive for abuse and a high-severity finding on internet-facing targets.

## Check for memcached UDP amplification exposure

```bash
nmap -sU -p 11211 $TARGET_IP
# PORT      STATE         SERVICE
# 11211/udp open|filtered memcache
```

Nmap often returns `open|filtered` for UDP because it cannot distinguish a filtered port from one that simply does not respond to empty probes. Send an actual Memcached command to get a definitive answer.

## Send a UDP stats Request

The Memcached UDP protocol requires an 8-byte header prepended to the command. Use this one-liner to send a valid UDP `stats` request and capture the response:

```bash
printf '\x00\x01\x00\x00\x00\x01\x00\x00stats\r\n' | nc -u -q2 $TARGET_IP 11211
# STAT pid 8821
# STAT uptime 2913847
# STAT curr_items 1204
# END
```

A `STAT` response confirms the UDP interface is active and accepting unauthenticated requests. No response means UDP is disabled or filtered.

## Confirm Amplification Factor

The amplification factor is the ratio of response size to request size. A `stats` request is around 15 bytes. The response can reach several kilobytes depending on how many statistics the instance returns. To measure it:

```bash
printf '\x00\x01\x00\x00\x00\x01\x00\x00stats\r\n' | nc -u -q2 $TARGET_IP 11211 | wc -c
```

Any response larger than the 15-byte request confirms amplification potential. Responses above 1000 bytes represent significant amplification. On internet-facing instances this is a critical finding regardless of what data is exposed.

## Check the Version for Default UDP Status

On Memcached 1.5.6 and later, UDP is disabled by default. If the version is below 1.5.6, UDP is on by default unless explicitly disabled. Retrieve the version over TCP first:

```bash
echo -e "version\r" | nc -q2 $TARGET_IP 11211
# VERSION 1.4.25
```

A version below 1.5.6 on a network-exposed instance should be treated as UDP-enabled until proven otherwise.

## Document the Finding

Record the following:

- Whether UDP port 11211 responds to unauthenticated requests
- The Memcached version and its default UDP behavior
- The measured amplification factor (response size vs request size)
- Whether the instance is internet-facing or internal

An internet-facing UDP-enabled instance is a critical misconfiguration. An internal one is lower severity but still exposes cache data over an unmonitored channel.

## References

- [Memcached 1.5.6 Release Notes](https://github.com/memcached/memcached/wiki/ReleaseNotes156) - UDP disabled by default from this version
- [Cloudflare: Memcached DDoS Attack](https://www.cloudflare.com/learning/ddos/memcached-ddos-attack) - Amplification factor and attack mechanics reference