CVE-2023-46853 Memory corruption in n/a

Critical 9.8 Published 27 Oct 2023 Updated 9 Sep 2024

An off-by-one error in Memcached proxy mode allows attackers to cause memory corruption, potentially leading to crashes or code execution.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-46853?

CVE-2023-46853 is a critical memory corruption vulnerability in n/a, published on 27 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Weakness: CWE-193

Which versions are affected by CVE-2023-46853?

1 open source package ship an affected version, including memcached. It affects 1 product.

Package	Affected	Fixed in
`memcached` Bitnami	All versions	`1.6.22`

Products include Memcached Memcached.

How do I fix CVE-2023-46853?

Upgrade memcached to 1.6.22 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-46853 being exploited?

There is no known exploitation of CVE-2023-46853 in the wild and no public exploit code.

Sources

Also known as AZL-31732, AZL-34977, BIT-memcached-2023-46853, DEBIAN-CVE-2023-46853, GHSA-jr2m-hrp3-3wj4, ROOT-OS-ALPINE-317-CVE-2023-46853 and 2 more.