CVE catalog

CVE-2013-7239

memcached: CVE-2013-7239

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.18% · Oct 25, 2026

memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmemcachedsid1.6.45-1fixed
Debianmemcachedforky1.6.45-1fixed
Debianmemcachedtrixie1.6.38-1fixed
Debianmemcachedbookworm1.6.18-1fixed
Debianmemcachedbookworm-security1.6.18-1+deb12u1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmemcachedsourcesid1.4.13-0.3not yet assignedNot reported[733643]
Debianmemcachedsourceforky1.4.13-0.3not yet assignedNot reported[733643]
Debianmemcachedsourcetrixie1.4.13-0.3not yet assignedNot reported[733643]
Debianmemcachedsourcebookworm1.4.13-0.3not yet assignedNot reported[733643]

[Debian bug #733643]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [memcached]Fixed
    Details (2)

    • 1.6.18-1 · amd64 · bookworm

      Fixed · Fixed: 1.4.13-0.3

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

    • 1.6.18-1 · arm64 · bookworm

      Fixed · Fixed: 1.4.13-0.3

      dsa · memcached · debian · bookworm; dsa · memcached · debian · 12

[Debian 13 (Trixie)]

  • [memcached]Fixed
    Details (2)

    • 1.6.38-1 · amd64 · trixie

      Fixed · Fixed: 1.4.13-0.3

      dsa · memcached · debian · 13

    • 1.6.38-1 · arm64 · trixie

      Fixed · Fixed: 1.4.13-0.3

      dsa · memcached · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]