CVE-2022-26635: PHP Memcached

Critical severity, CVSS 9.8. EPSS: 21.4% chance of exploitation in the next 30 days.

PHP-Memcached v2.2.0 and below contains an improper NULL termination which allows attackers to execute CLRF injection. Note: Third parties have disputed this as not affecting PHP-Memcached directly.

Affected products

• PHP Memcached: up to and including 2.2.0

Published 2022-04-05. Last modified 2026-06-17.