CVE-2023-27478

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

libmemcached-awesome is an open source C/C++ client library and tools for the memcached server. `libmemcached` could return data for a previously requested key, if that previous request timed out due to a low `POLL_TIMEOUT`. This issue has been addressed in version 1.1.4. Users are advised to upgrade. There are several ways to workaround or lower the probability of this bug affecting a given deployment. 1: use a reasonably high `POLL_TIMEOUT` setting, like the default. 2: use separate libmemcached connections for unrelated data. 3: do not re-use libmemcached connections in an unknown state.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
awesomized	libmemcached	> 1.0.18, < 1.1.4

References

https://github.com/awesomized/libmemcached/commit/48dcc61aPatch
https://github.com/awesomized/libmemcached/releases/tag/1.1.4Release Notes
https://github.com/awesomized/libmemcached/security/advisories/GHSA-wwmh-39wj-fx59Patch, Third Party Advisory
https://github.com/php-memcached-dev/php-memcached/issues/531Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/awesomized/libmemcached/commit/48dcc61aPatch
https://github.com/awesomized/libmemcached/releases/tag/1.1.4Release Notes
https://github.com/awesomized/libmemcached/security/advisories/GHSA-wwmh-39wj-fx59Patch, Third Party Advisory
https://github.com/php-memcached-dev/php-memcached/issues/531Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Mar 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-274799.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2023-274807.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with CVE-2023-274814.3Directus is a real-time API and App dashboard for managing SQL database content. In versions prior to 9.16.0 users with read access to the `CVE-2023-2748210.0homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Superv CVE-2023-274837.5crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An out of memory pani CVE-2023-274844.9crossplane-runtime is a set of go libraries used to build Kubernetes controllers in Crossplane and its related stacks. In affected versions CVE-2023-274854.3thmmniii/fbs-core is an open source feedback system for students. In versions prior to 1.5.3 when querying `subresults`, it is possible to q CVE-2023-274868.8xCAT is a toolkit for deployment and administration of computer clusters. In versions prior to 2.16.5 if zones are configured as a mechanism CVE-2023-274879.1Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and CVE-2023-274889.8Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and CVE-2023-274895.4Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users whic CVE-2023-27497.5Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorize