CVE-2023-46853: 
Memcached vulnerability analysis and mitigation

In Memcached versions before 1.6.22, an off-by-one error vulnerability (CVE-2023-46853) was discovered when processing proxy requests in proxy mode. The vulnerability specifically occurs when '\n' is used instead of '\r\n' in request processing (NVD).

The vulnerability is classified as an off-by-one error (CWE-193) with a CVSS v3.1 Base Score of 9.8 (CRITICAL), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from parser assumptions about line endings, where some commands worked and others broke in subtle ways when only '\n' was being submitted instead of the expected '\r\n' (GitHub Patch).

A remote attacker could potentially exploit this vulnerability to cause Memcached to crash, resulting in a denial of service, or possibly execute arbitrary code (Ubuntu Notice).

The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction. The attack vector is network-accessible, making it particularly concerning for exposed Memcached instances (NVD).

The vulnerability has been fixed in Memcached version 1.6.22. Users are advised to upgrade to this version or later. For Ubuntu users, specific package updates are available: Ubuntu 23.10 (1.6.21-1ubuntu0.23.10.1), Ubuntu 23.04 (1.6.18-1ubuntu0.1), and Ubuntu 22.04 (1.6.14-1ubuntu0.1) (Ubuntu Notice).