The way your application server is configured could one of the possible way an attacker can use their accessibility opportunities - this will be defined as the attack surface for the application.
As you decided to keep it memcache based context, I would deliver you the protections instead of measuring the attack surface since this depends on the interfaces that are exposed to the public facing front. If you are at debian, use this to configure IPSec.
iptables -A INPUT -s 18.104.22.168/32 -p tcp --destination-port 11211 -j ALLOW
iptables -A INPUT -s 0.0.0.0/0 -p tcp --destination-port 11211 -j DROP
Use the above to protect from compromises if at all an attacker tries to backconnect and then root. This depends again on the usability such as if your use case is served via blocking all other ports except the one which you use. If memcached rely on the same system which has accessibility and talk to your MySQL instances, you might need to worry if any of the interfaces have been exploited. If they both are on the same system - your webserver will communicate with memcached rather then the mysql server and hence any exploitibility likelihood to webserver will lead clear consequences to your web database as well.
I also encourage to look at this, which will further deliver you the attack surface study.