Every CVE Search/ Get API key

CVE-2023-46853

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy...

9.8 CriticalFix available

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.88%Up 0.8 points since Oct 28, 2023
90%50%10%1%

What each source reports

NVD Score used 9.8

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
CVE-2023-46853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-193
Updated
2026-11-02
CVE List No score

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
CVE-2023-46853
Updated
2026-11-02
EUVDEUVD-2023-51019 No score

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
EUVD-2023-51019
Updated
2026-11-03
GitHub AdvisoriesGHSA-jr2m-hrp3-3wj4 9.8

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy...

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
GHSA-jr2m-hrp3-3wj4
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-193
Updated
2026-11-02
OSVAZL-31732 9.8

CVE-2023-46853 affecting package memcached for versions less than 1.6.22-1

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
AZL-31732
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-34977 9.8

CVE-2023-46853 affecting package memcached for versions less than 1.6.27-1

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
AZL-34977
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2023-46853 9.8

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
DEBIAN-CVE-2023-46853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-46853 9.8

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
UBUNTU-CVE-2023-46853
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBIT-memcached-2023-46853 No score

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
BIT-memcached-2023-46853
Updated
2026-11-02
OSV No score

In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n.

Record
CVE-2023-46853
Updated
2026-11-02
OSVopenSUSE-SU-2024:13427-1 No score

memcached-1.6.22-1.1 on GA media

These are all security issues fixed in the memcached-1.6.22-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13427-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-317-CVE-2023-46853 No score

CVE-2023-46853 in memcached - Patched by Root

Root has patched CVE-2023-46853 in the memcached package for Root:Alpine:3.17. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-317-CVE-2023-46853
Updated
2026-11-02
OSVROOT-OS-ALPINE-318-CVE-2023-46853 No score

CVE-2023-46853 in memcached - Patched by Root

Root has patched CVE-2023-46853 in the memcached package for Root:Alpine:3.18. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-318-CVE-2023-46853
Updated
2026-11-02
OSVUSN-6476-1 No score

memcached vulnerabilities

It was discovered that Memcached incorrectly handled certain multiget requests in proxy mode. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-46852)

It was discovered that Memcached incorrectly handled certain proxy requests in proxy mode. A remote attacker could use this issue to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-46853)

Record
USN-6476-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
memcached
Azure Linux:2
 before 1.6.22-1
1.6.22-1
memcached
Azure Linux:3
 before 1.6.27-1
1.6.27-1
memcached
Bitnami
 before 1.6.22
1.6.22
memcached
Debian:12
 before 1.6.18-1+deb12u1, plus listed versions
1.6.18-1
1.6.18-1+deb12u1
memcached
Debian:13
 before 1.6.22-1
1.6.22-1
memcached
Debian:14
 before 1.6.22-1
1.6.22-1
memcached
Root:Alpine:3.17
 before 1.6.17-r00071
1.6.17-r000711.6.17-r000721.6.17-r000731.6.17-r000741.6.17-r00075
rootio-memcached
Root:Alpine:3.17
 before 1.6.17-r00071
1.6.17-r000711.6.17-r000721.6.17-r000731.6.17-r000741.6.17-r00075
memcached
Root:Alpine:3.18
 before 1.6.21-r00071
1.6.21-r000711.6.21-r000731.6.21-r000721.6.21-r000741.6.21-r00075
rootio-memcached
Root:Alpine:3.18
 before 1.6.21-r00071
1.6.21-r000711.6.21-r000731.6.21-r000721.6.21-r000741.6.21-r00075
memcached
Ubuntu:22.04:LTS
 before 1.6.14-1ubuntu0.1, plus listed versions
1.6.9+dfsg-1build11.6.12+dfsg-2ubuntu11.6.12+dfsg-31.6.12+dfsg-41.6.13-11.6.14-1
1.6.14-1ubuntu0.1
memcached
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 1.6.14-1ubuntu0.1, plus listed versions
1.6.9+dfsg-1build11.6.12+dfsg-2ubuntu11.6.12+dfsg-31.6.12+dfsg-41.6.13-11.6.14-1
1.6.14-1ubuntu0.1
memcached
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 1.6.22-1.1
1.6.22-1.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-46853 is a critical vulnerability (CVSS 9.8) in Memcached, published October 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in memcached 1.6.22-1.

References

Show 6 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open