Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2023-5156: glibc memory leak can crash applications
CVE-2023-5156 · published 3 years ago
Summary
The GNU C Library (glibc) on several Linux distributions may leak memory when handling certain network lookups, eventually causing programs to stop working. This can affect servers and applications that rely on the library for DNS queries. Apply the latest updates from your Linux vendor to fix the issue.
What to do
- Update debian glibc to version 2.37-11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | glibc |
< 2.37-11 Fix: upgrade to 2.37-11
|
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
Original advisory text
Glibc: dos due to memory leak in getaddrinfo.c
A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.
References
- http://www.openwall.com/lists/oss-security/2023/10/03/4 URL
- https://access.redhat.com/downloads/content/package-browser/ URL
- https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=ec6b95c3303c700eb89eebeda... URL
- https://security-tracker.debian.org/tracker/CVE-2023-5156 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/10/03/5 URL
- http://www.openwall.com/lists/oss-security/2023/10/03/6 URL
- https://sourceware.org/bugzilla/show_bug.cgi?id=30884 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2023/10/03/8 URL
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html URL
- https://cert-portal.siemens.com/productcert/html/ssa-831302.html URL
- https://access.redhat.com/security/cve/CVE-2023-5156 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5156.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-5156 Vendor Advisory
- https://security.gentoo.org/glsa/202402-01 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2240541 Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-401Memory Leak
Timeline
Published25 Sep 2023
Updated3 Nov 2026
First seen6 Aug 2026
Track software like this
Free during beta