Is port 11211 (Memcached) exposed to the internet?

A cache designed for trusted networks, not the open internet

Memcached is a widely used in-memory key-value cache, and IANA’s Service Name and Port Number Registry formally registers both TCP and UDP port 11211 to it under the name memcache. Its own official configuration documentation is unusually direct about the threat model it was built for: “Memcached does not spend much, if any, effort in ensuring its defensibility from random internet connections. So you must not expose memcached directly to the internet, or otherwise any untrusted users.” That’s not a hedge buried in a security appendix — it’s the project’s own framing of what the software is and isn’t designed to resist.

Two separate risks, not one

An internet-reachable, unauthenticated Memcached instance exposes whatever an application cached in it — session identifiers, database query results, anything stored there for speed rather than for public access — to any caller that can reach the port. That alone is a real exposure. But Memcached’s UDP interface adds a second, unrelated risk: it can be abused as a reflection amplification vector, where an attacker sends a small forged-source-address request and the server replies with a response many times larger, aimed at whatever third-party address the attacker spoofed. CISA’s advisory on UDP-based amplification attacks lists memcached’s bandwidth amplification factor at 10,000 to 51,000 — far higher than any other protocol on that same list — meaning a server with nothing sensitive cached at all can still be conscripted into flooding someone else’s infrastructure, with your IP address as the apparent source.

Authentication exists, but isn’t the primary control

Memcached does support SASL authentication, but the project’s own documentation is careful not to oversell it: “Using SASL authentication here helps, but should not be totally trusted.” The guidance that follows treats network-level restriction — binding to a private or loopback interface, not all interfaces — as the actual primary control, with authentication as a secondary layer on top of that, not a substitute for it.

Check your own exposure

AdminKit’s port-check tool automates reachability checks for a fixed set of nine commonly-misconfigured ports today, and 11211 isn’t on that list yet. Confirm your current public IP with what is my IP, then test the port manually from a machine outside your network:

nc -vz -w 3 203.0.113.5 11211

A successful connection means the port is reachable from the internet; “connection refused” or a timeout means it’s closed or filtered. Run this only against a host you own or are authorized to test.

The same no-auth-by-default pattern as other fast data stores

Memcached’s risk profile closely mirrors Redis’s and Elasticsearch’s own default-open design — software built for speed inside a trusted network, not for defending itself at the edge. The fix pattern is the same across all three: restrict network access first, treat any built-in authentication as a second layer rather than the whole plan, and never assume a service is private just because nobody deliberately opened its port.

This guide is general information, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.