CVE-2023-43768

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
couchbase	couchbase_server	>= 6.6.0, < 7.1.5
couchbase	couchbase_server	>= 7.2.0, < 7.2.1

References

https://docs.couchbase.com/server/current/release-notes/relnotes.htmlRelease Notes
https://forums.couchbase.com/tags/securityProduct
https://www.couchbase.com/alerts/Vendor Advisory
https://www.couchbase.com/downloadsProduct
https://docs.couchbase.com/server/current/release-notes/relnotes.htmlRelease Notes
https://forums.couchbase.com/tags/securityProduct
https://www.couchbase.com/alerts/Vendor Advisory
https://www.couchbase.com/downloadsProduct

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-437696.3An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed CVE-2023-437706.1Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of CVE-2023-437715.5In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.CVE-2023-437755.3Denial-of-service vulnerability in the web server of the Eaton SMP Gateway allows attacker to potentially force an unexpected restart of t CVE-2023-437766.6Eaton easyE4 PLC offers a device password protection functionality to facilitate a secure connection and prevent unauthorized access. It was CVE-2023-437776.5Eaton easySoft software is used to program easy controllers and displays for configuring, programming and defining parameters for all the in CVE-2023-43784.3An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before CVE-2023-437825.5Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File. The file is used even if it has been created CVE-2023-437837.5Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The filename is used even if it has been created CVE-2023-437847.5Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's posit CVE-2023-437855.5A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trig CVE-2023-437865.5A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all