Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-46853: Memcached can mishandle proxy requests and crash

CVE-2023-46853 · published 11 days ago

Summary

Older versions of Memcached (before 1.6.22) on Alpine and Debian can mishandle proxy requests that use a single line‑feed character instead of the required carriage‑return/line‑feed sequence. This off‑by‑one mistake may cause the service to stop working, disrupting any applications that rely on it. Upgrade Memcached to version 1.6.22 or later to resolve the issue.

What to do

Update alpine rootio-memcached to version 1.6.17-r00074.
Update alpine rootio-memcached to version 1.6.21-r00074.
Update debian memcached to version 1.6.22-1.
Update memcached to version 1.6.21-r00075.
Update rootio-memcached to version 1.6.21-r00075.
Update memcached to version 1.6.17-r00075.
Update rootio-memcached to version 1.6.17-r00075.
Update memcached memcached to version 1.6.22 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Root:Alpine:3.17	alpine	rootio-memcached	< 1.6.17-r00074 Fix: upgrade to 1.6.17-r00074
Root:Alpine:3.18	alpine	rootio-memcached	< 1.6.21-r00074 Fix: upgrade to 1.6.21-r00074
Debian:12	debian	memcached	All versions
Debian:13	debian	memcached	< 1.6.22-1 Fix: upgrade to 1.6.22-1
Root:Alpine:3.18	–	memcached	< 1.6.21-r00075 Fix: upgrade to 1.6.21-r00075
Root:Alpine:3.18	–	rootio-memcached	< 1.6.21-r00075 Fix: upgrade to 1.6.21-r00075
–	memcached	memcached	< 1.6.22 `cpe:2.3:a:memcached:memcached::::::::`
Root:Alpine:3.17	–	memcached	< 1.6.17-r00075 Fix: upgrade to 1.6.17-r00075
Root:Alpine:3.17	–	rootio-memcached	< 1.6.17-r00075 Fix: upgrade to 1.6.17-r00075

Original advisory text

CVE-2023-46853 in memcached - Patched by Root

Root has patched CVE-2023-46853 in the memcached package for Root:Alpine:3.17. Multiple fixed versions available.

References

https://security-tracker.debian.org/tracker/CVE-2023-46853 Vendor Advisory
https://github.com/memcached/memcached/commit/6987918e9a3094ec4fc8976f01f769f624... Patch
https://github.com/memcached/memcached/compare/1.6.21...1.6.22 Release Notes

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-193Off-by-one Error

Timeline

Published29 Sep 2026

Updated7 Oct 2026

First seen30 Mar 2026

Sources

ROOT-OS-ALPINE-317-CVE-2023-46853 · OSV

ROOT-OS-ALPINE-318-CVE-2023-46853 · OSV

CVE-2023-46853 · OSV

CVE-2023-46853 · NVD

DEBIAN-CVE-2023-46853 · OSV

Track software like this

Free during beta