Memcached at Internet Scale: 1,441,421 Fingerprint Matches Against 1,129,100 on Port 11211

Memcached is a cache, which makes it easy to dismiss as low risk. It has no access control in its default configuration, it answers a simple text protocol, and a cache miss returns nothing an attacker wanted anyway. Those properties also describe a service that can be enumerated at scale, and the measurement below shows how large that population is.

Method and scope

Queries were run on 2026-09-28 using ZoomEye. Counts are matching assets for the stated query. A positive result confirms that a service matching the signature is reachable from the internet at the time of measurement. It does not confirm that the service stores sensitive data or that it is reachable without restriction.

The fingerprint count exceeds the port count, which is the reverse of the pattern seen with several other services. An asset can be fingerprinted from a response on one port while another port carries the count, so the two populations overlap without being identical.

What an exposed cache exposes

The default configuration of Memcached listens on all interfaces and applies no authentication. Anyone who can open a TCP connection to port 11211 can issue stats, get, set and flush_all commands. The stats response alone leaks uptime, item counts, connection counts and, in versions where it is exposed, the slab allocation histogram that reveals memory sizing.

The more serious concern is what is stored. Caches are frequently used for session state, API response bodies and rendered fragments, which means the contents can include session identifiers, personal data and internal responses that were never meant to be read outside the application. A flush_all command is also a denial of service against every user of that cache.

The protocol has a UDP mode as well. When it is enabled, it provides an amplification vector, because a small request can produce a much larger response to a spoofed source address.

Reducing the population that matters

Most of the assets in these counts are unlikely to be readable from an arbitrary source. Hosting providers block the port, cloud security groups restrict it, or the service sits behind a network device that does not forward the traffic. The measurement describes reachability at the network layer, which is a necessary but not sufficient condition for data exposure.

The efficient way to work through a number this size is to filter it by ownership before investigating individual hosts. ZoomEye queries can be narrowed by the autonomous system or by the geographic location of the asset, which lets an organisation select the subset that belongs to it. Applying asn and region filters to the same fingerprint query turns a global figure into a list that can be actioned.

The later queries are also the ones that show whether the population is stable. A cache fleet that grows by a fixed percentage each quarter is a different operational problem from one that is flat but concentrated in a small number of networks.

For defence, the control is the same in every case: bind the service to the interface the application uses, place it behind a network policy, and treat cache contents as data that would be damaging if read. Where a cache must be shared between services, the network policy is the access control.

References

• Memcached wiki, Security: https://github.com/memcached/memcached/wiki/Security
• ZoomEye documentation: https://www.zoomeye.ai/doc