{"id":"CVE-2023-5156","aliases":["AZL-30046","AZL-34734","BELL-CVE-2023-5156","DEBIAN-CVE-2023-5156","EUVD-2023-57494","GHSA-m7p3-g2hx-xfc3","MGASA-2023-0281","OESA-2023-1688","UBUNTU-CVE-2023-5156","USN-6541-1"],"status":"published","title":"Glibc: dos due to memory leak in getaddrinfo.c","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01626,"percentile":0.76329,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2023-09-25T15:55:15Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:2","package":"glibc","fixed_in":["2.35-6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"glibc","fixed_in":["2.38-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"glibc","fixed_in":["2.37.0-r6"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"glibc","fixed_in":["2.37.0-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"glibc","fixed_in":["2.37.0-r6"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"glibc","fixed_in":["2.37.0-r6"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"glibc","fixed_in":["2.37-11"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"glibc","fixed_in":["2.37-11"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"glibc","fixed_in":["2.36-50.mga9"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"glibc","fixed_in":["2.35-0ubuntu3.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35-6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.38-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.37.0-r6"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.37.0-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.37.0-r6"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.37.0-r0"},{"fixed":"2.37.0-r6"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37-11"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37-11"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36-50.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-97.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28-97.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-136.oe2203sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-136.oe2203sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.34-136.oe2203sp2"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"eglibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17-93ubuntu4","2.18-0ubuntu1","2.18-0ubuntu2","2.18-0ubuntu4","2.18-0ubuntu5","2.18-0ubuntu6","2.18-0ubuntu7","2.19-0ubuntu2","2.19-0ubuntu3","2.19-0ubuntu4","2.19-0ubuntu5","2.19-0ubuntu6","2.19-0ubuntu6.1","2.19-0ubuntu6.3","2.19-0ubuntu6.4","2.19-0ubuntu6.5","2.19-0ubuntu6.6","2.19-0ubuntu6.7","2.19-0ubuntu6.8","2.19-0ubuntu6.9","2.19-0ubuntu6.10","2.19-0ubuntu6.11","2.19-0ubuntu6.13","2.19-0ubuntu6.14","2.19-0ubuntu6.15","2.19-0ubuntu6.15+esm1","2.19-0ubuntu6.15+esm2","2.19-0ubuntu6.15+esm3","2.19-0ubuntu6.15+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35-0ubuntu3.5"}]}],"versions":["2.34-0ubuntu3","2.35-0ubuntu1","2.35-0ubuntu3","2.35-0ubuntu3.1","2.35-0ubuntu3.3","2.35-0ubuntu3.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.23-0ubuntu11.3+esm5"}]}],"versions":["2.21-0ubuntu4","2.21-0ubuntu5","2.21-0ubuntu6","2.23-0ubuntu1","2.23-0ubuntu2","2.23-0ubuntu3","2.23-0ubuntu4","2.23-0ubuntu5","2.23-0ubuntu6","2.23-0ubuntu7","2.23-0ubuntu9","2.23-0ubuntu10","2.23-0ubuntu11","2.23-0ubuntu11.2","2.23-0ubuntu11.3","2.23-0ubuntu11.3+esm1","2.23-0ubuntu11.3+esm2","2.23-0ubuntu11.3+esm3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.27-3ubuntu1.6+esm1"}]}],"versions":["2.26-0ubuntu2","2.26-0ubuntu2.1","2.27-0ubuntu2","2.27-0ubuntu3","2.27-3ubuntu1","2.27-3ubuntu1.2","2.27-3ubuntu1.3","2.27-3ubuntu1.4","2.27-3ubuntu1.5","2.27-3ubuntu1.6"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.31-0ubuntu9.14"}]}],"versions":["2.30-0ubuntu2","2.30-0ubuntu3","2.31-0ubuntu5","2.31-0ubuntu6","2.31-0ubuntu7","2.31-0ubuntu9","2.31-0ubuntu9.1","2.31-0ubuntu9.2","2.31-0ubuntu9.3","2.31-0ubuntu9.7","2.31-0ubuntu9.9","2.31-0ubuntu9.12"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"glibc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.35-0ubuntu3.5"}]}],"versions":["2.34-0ubuntu3","2.35-0ubuntu1","2.35-0ubuntu3","2.35-0ubuntu3.1","2.35-0ubuntu3.3","2.35-0ubuntu3.4"],"bundled":3}],"products":[{"vendor":"gnu","product":"glibc"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-5156","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240541","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Patch","report"]},{"url":"https://sourceware.org/bugzilla/show_bug.cgi?id=30884","tags":["x_transferred","Issue Tracking","Patch","report"]},{"url":"https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ec6b95c3303c700eb89eebeda2d7264cc184a796","tags":["x_transferred","Mailing List","Patch","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/03/4","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/03/5","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/03/6","tags":["x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/03/8","tags":["x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202402-01","tags":["x_transferred","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-831302.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5156","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m7p3-g2hx-xfc3"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-5156","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2023-2","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5156.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5156","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32328","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5156","tags":["advisory","report"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1688","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4813","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-5156","tags":["report"]},{"url":"https://sourceware.org/pipermail/libc-alpha/2023-September/151691.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6541-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6541-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-4806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-4813","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-5156","title":"Glibc: dos due to memory leak in getaddrinfo.c","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T15:55:15.558Z","modified":"2026-11-07T06:11:50.271Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-401"],"updated_at":"2026-11-07T07:33:04.747512Z"}],"euvd":[{"id":"EUVD-2023-57494","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T15:55:15Z","modified":"2026-11-07T06:11:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T07:08:38.556533Z"}],"ghsa":[{"id":"GHSA-m7p3-g2hx-xfc3","title":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential...","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T18:30:51Z","modified":"2026-10-15T00:30:42Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:13:29.914076Z"}],"nvd":[{"id":"CVE-2023-5156","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T16:15:15.613Z","modified":"2026-11-07T07:17:01.727Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-07T12:05:05.609476Z"}],"osv":[{"id":"AZL-30046","title":"CVE-2023-5156 affecting package glibc for versions less than 2.35-6","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T16:15:15Z","modified":"2026-04-21T04:26:02.404451Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34734","title":"CVE-2023-5156 affecting package glibc for versions less than 2.38-6","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T16:15:15Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"BELL-CVE-2023-5156","status":"published","published":"2023-09-25T16:15:00Z","modified":"2026-01-26T09:36:47.647383Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:18.192656Z"},{"id":"CVE-2023-5156","title":"Glibc: dos due to memory leak in getaddrinfo.c","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T15:55:15.558Z","modified":"2026-10-28T02:30:22.041805284Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-5156","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T16:15:15.613Z","modified":"2026-11-07T09:47:29.48406525Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-07T10:14:39.995311Z"},{"id":"OESA-2023-1688","title":"glibc security update","description":"The GNU C Library project provides the core libraries for the GNU system and GNU/Linux systems, as well as many other systems that use Linux as the kernel. These libraries provide critical APIs including ISO C11, POSIX.1-2008, BSD, OS-specific APIs and more. These APIs include such foundational facilities as open, read, write, malloc, printf, getaddrinfo, dlopen, pthread_create, crypt,  login, exit and more.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.(CVE-2023-4806)\r\n\r\nA flaw was found in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the getaddrinfo function is called and the hosts database in /etc/nsswitch.conf is configured with SUCCESS=continue or SUCCESS=merge.(CVE-2023-4813)\r\n\r\nA flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.(CVE-2023-5156)","status":"published","published":"2023-09-28T11:06:08Z","modified":"2026-08-18T01:16:54.715451993Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2023-5156","description":"A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.","status":"published","published":"2023-09-25T16:15:00Z","modified":"2026-04-22T14:15:28.797821Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"MGASA-2023-0281","title":"Updated glibc packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\n\nA flaw was found in the GNU C Library. A recent fix for CVE-2023-4806\nintroduced the potential for a memory leak, which may result in an\napplication crash. (CVE-2023-5156)\n","status":"published","published":"2023-10-03T10:53:29Z","modified":"2026-05-30T05:15:05.824699259Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-6541-1","title":"glibc vulnerabilities","description":"It was discovered that the GNU C Library was not properly handling certain\nmemory operations. An attacker could possibly use this issue to cause a\ndenial of service (application crash). (CVE-2023-4806, CVE-2023-4813)\n\nIt was discovered that the GNU C library was not properly implementing a\nfix for CVE-2023-4806 in certain cases, which could lead to a memory leak.\nAn attacker could possibly use this issue to cause a denial of service\n(application crash). This issue only affected Ubuntu 22.04 LTS and Ubuntu\n23.04. (CVE-2023-5156)\n","status":"published","published":"2023-12-07T16:24:50Z","modified":"2026-06-25T13:32:02.717498916Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}