Backport memcached authentication token and binary protocol crash fixes

SPECS/memcached/memcached-auth-token-length.patch

@@ -0,0 +1,73 @@
+From 9981d748f866e80a8f2ee1b12bf45717f9595df9 Mon Sep 17 00:00:00 2001
+From: dormando <dormando@rydia.net>
+Date: Fri, 1 May 2026 14:15:19 -0700
+Subject: [PATCH] auth: fix crash when given huge token
+
+Also prevents memory bloat when given extremely but not existentially
+large auth tokens.
+
+Reported by Haruto Kimura (Stella)
+
+Upstream Patch Reference : https://github.com/memcached/memcached/commit/9981d748f8
+---
+ proto_text.c   | 13 +++++++++++++
+ t/ascii-auth.t |  6 +++++-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/proto_text.c b/proto_text.c
+index b213c93..69fd169 100644
+--- a/proto_text.c
++++ b/proto_text.c
+@@ -332,6 +332,8 @@ static size_t tokenize_command(char *command, token_t *tokens,
+     return ntokens;
+ }
+
++#define MAX_AUTH_REQ_LEN 16384
++
+ int try_read_command_asciiauth(conn *c) {
+     token_t tokens[MAX_TOKENS];
+     size_t ntokens;
+@@ -383,6 +385,17 @@ int try_read_command_asciiauth(conn *c) {
+             return 1;
+         }
+
++        if (size > MAX_AUTH_REQ_LEN) {
++            if (!c->resp) {
++                if (!resp_start(c)) {
++                    conn_set_state(c, conn_closing);
++                    return 1;
++                }
++            }
++            out_string(c, "CLIENT_ERROR auth token too long");
++            return 1;
++        }
++
+         // we don't actually care about the key at all; it can be anything.
+         // we do care about the size of the remaining read.
+         c->rlbytes = size + 2;
+diff --git a/t/ascii-auth.t b/t/ascii-auth.t
+index 40ca376ec4..4fad020195 100644
+--- a/t/ascii-auth.t
++++ b/t/ascii-auth.t
+@@ -1,7 +1,7 @@
+ #!/usr/bin/env perl
+
+ use strict;
+-use Test::More tests => 9;
++use Test::More tests => 10;
+ use FindBin qw($Bin);
+ use lib "$Bin/lib";
+ use MemcachedTest;
+@@ -21,6 +21,10 @@ like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to do a read");
+ print $sock "set foo 0 0 7\r\nfoo bab\r\n";
+ like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to authenticate");
+
++# Super long tokens are invalid.
++print $sock "set foo 0 0 2147483646\r\nasfd\r\n";
++like(scalar <$sock>, qr/CLIENT_ERROR/, "failed to authenticate");
++
+ # Try for real.
+ print $sock "set foo 0 0 7\r\nfoo bar\r\n";
+ like(scalar <$sock>, qr/STORED/, "authenticated?");
+-- 
+2.45.4

SPECS/memcached/memcached.spec

@@ -7,7 +7,7 @@
 Summary:        High Performance, Distributed Memory Object Cache
 Name:           memcached
 Version:        1.6.27
-Release:        5%{?dist}
+Release:        6%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -19,6 +19,8 @@ Patch1:         CVE-2021-43519.patch
 Patch2:         CVE-2021-44647.patch
 Patch3:         CVE-2026-24809.patch
 Patch4:         CVE-2026-47783.patch
+Patch5:         memcached-auth-token-length.patch
+Patch6:         proto-fix-crash-in-binary-protocol.patch
 BuildRequires:  gcc
 BuildRequires:  libevent-devel
 BuildRequires:  systemd-devel
@@ -133,6 +135,10 @@ exit 0
 %{_unitdir}/memcached.service
 
 %changelog
+* Tue Aug 18 2026 Pawel Winogrodzki <pawelwi@microsoft.com> - 1.6.27-6
+- Prevent oversized ASCII authentication tokens from crashing the daemon
+- Fix crash in binary protocol
+
 * Thu May 21 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.6.27-5
 - Patch for CVE-2026-47783
 

SPECS/memcached/proto-fix-crash-in-binary-protocol.patch

@@ -0,0 +1,31 @@
+From 2e623108dec9759ad3e258aa695288a1ef6a0c72 Mon Sep 17 00:00:00 2001
+From: dormando <dormando@rydia.net>
+Date: Fri, 1 May 2026 13:48:44 -0700
+Subject: [PATCH] proto: fix crash in binary protocol
+
+If `watch mutations` is running and a binary protocol SET fails the
+logger code attempts to resolve a NULL item reference and will crash.
+
+Reported by Haruto Kimura (Stella)
+
+Upstream Patch Reference : https://github.com/memcached/memcached/commit/32ea7d8b5b
+---
+ proto_bin.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/proto_bin.c b/proto_bin.c
+index 778ea9a..0e92539 100644
+--- a/proto_bin.c
++++ b/proto_bin.c
+@@ -1136,7 +1136,7 @@ static void process_bin_update(conn *c, char *extbuf) {
+         /* FIXME: losing c->cmd since it's translated below. refactor? */
+         LOGGER_LOG(c->thread->l, LOG_MUTATIONS, LOGGER_ITEM_STORE,
+                 NULL, status, 0, key, nkey, req->message.body.expiration,
+-                ITEM_clsid(it), c->sfd);
++                0, c->sfd);
+
+         /* Avoid stale data persisting in cache because we failed alloc.
+          * Unacceptable for SET. Anywhere else too? */
+-- 
+2.55.0
+