CVE catalog

CVE-2023-27478

libmemcached: CVE-2023-27478

Severity: Medium
Published: Mar 7, 2023, 6:15:09 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.75% · Oct 25, 2026

libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libmemcached	sid	`1.1.4-1.2`	fixed
Debian	libmemcached	forky	`1.1.4-1.2`	fixed
Debian	libmemcached	trixie	`1.1.4-1.1`	fixed
Debian	libmemcached	bookworm	`1.1.4-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libmemcached	source	sid	`1.1.4-1`	not yet assigned	Not reported	[1032479]
Debian	libmemcached	source	forky	`1.1.4-1`	not yet assigned	Not reported	[1032479]
Debian	libmemcached	source	trixie	`1.1.4-1`	not yet assigned	Not reported	[1032479]
Debian	libmemcached	source	bookworm	`1.1.4-1`	not yet assigned	Not reported	[1032479]

[Debian bug #1032479]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]