CVE-2023-46852

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-27 · updated 2026-06-17
Weakness: CWE-120

Description

In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring.

Affected products

Memcached: before 1.6.22 — fixed in 1.6.22

How to fix

Upgrade to a fixed version: Memcached 1.6.22. Check the vendor advisory for mitigations.

References

https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767
https://github.com/memcached/memcached/compare/1.6.21...1.6.22
https://github.com/memcached/memcached/commit/76a6c363c18cfe7b6a1524ae64202ac9db330767
https://github.com/memcached/memcached/compare/1.6.21...1.6.22

Get alerted when CVE-2023-46852 or the next vulnerability affects your stack