CVE-2023-5156 Glibc: dos due to memory leak in getaddrinfo.c

What is CVE-2023-5156?

CVE-2023-5156 is a high-severity denial of service vulnerability in Gnu Glibc, published on 25 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.

Weakness: CWE-401

Which versions are affected by CVE-2023-5156?

It affects 2 products.

Products include Gnu Glibc, Redhat Enterprise Linux.

How do I fix CVE-2023-5156?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-5156 being exploited?

There is no known exploitation of CVE-2023-5156 in the wild and no public exploit code.

Other vulnerabilities in Gnu Glibc

• CVE-2026-5450 scanf %mc off-by-one heap buffer overflow Critical 9.8
• CVE-2023-25139 Memory corruption in n/a Critical 9.8
• CVE-1999-0199 Other in n/a Critical 9.8
• CVE-2019-1010022 Security feature bypass in glibc Critical 9.8
• CVE-2005-3590 Memory corruption in n/a Critical 9.8

All Gnu Glibc vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-30046, AZL-34734, BELL-CVE-2023-5156, DEBIAN-CVE-2023-5156, GHSA-m7p3-g2hx-xfc3, MGASA-2023-0281 and 1 more.