AIKIDO-2026-27592

TL;DR

Dalli's pipelined reply parser uses any reply line without a value body, such as CLIENT_ERROR or SERVER_ERROR, as the MN marker that ends a batched get_multi request, so it stops reading early and leaves the remaining replies on the connection for later commands to read as their own. memcached returns CLIENT_ERROR for a key over 250 bytes on the wire, and Dalli measures key length in characters before base64-encoding non-ASCII or whitespace keys, so a key under the character limit can still trigger it. A later get on the same connection can then return a different key's value, exposing another user's cached data through get_multi, get_multi_cas, or Rails read_multi against more than one memcached server. The fix stops only on the actual MN reply and measures keys in the bytes actually sent.