CVE-2023-46853: 
Memcached vulnerability analysis and mitigation

In Memcached versions before 1.6.22, an off-by-one error vulnerability (CVE-2023-46853) was discovered when processing proxy requests in proxy mode. The vulnerability specifically occurs when '\n' is used instead of '\r\n' in request processing (NVD).

The vulnerability is classified as an off-by-one error (CWE-193) with a CVSS v3.1 Base Score of 9.8 (CRITICAL), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from parser assumptions about line endings, where some commands worked and others broke in subtle ways when only '\n' was being submitted instead of the expected '\r\n' (GitHub Patch).

A remote attacker could potentially exploit this vulnerability to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code (Ubuntu Notice).

The vulnerability has been fixed in Memcached version 1.6.22. Users are advised to upgrade to this version or later. For Ubuntu users, specific package updates are available: Ubuntu 23.10 (1.6.21-1ubuntu0.23.10.1), Ubuntu 23.04 (1.6.18-1ubuntu0.1), and Ubuntu 22.04 (1.6.14-1ubuntu0.1) (Ubuntu Notice).