AIKIDO-2026-279943

dalli is vulnerable to Deserialization of Untrusted Data

Deserialization of Untrusted DataGHSA-wr87-m4jw-29x5 Published 6 days ago

Low Risk

This Affects:

dalli

0.0.1 - 3.2.12

Fixed in 3.2.13

4.0.0 - 4.3.6

Fixed in 4.3.7

5.0.0 - 5.0.9

Fixed in 5.0.10

5.1.0 - 5.1.3

Fixed in 5.1.4

5.2.0 - 5.2.1

Fixed in 5.2.2

Are you affected? Scan for Free

TL;DR

Several read methods skip a per request raw: true option and still run the configured serializer's load, Marshal by default, on any value whose stored flags mark it serialized. serializer: JSON calls JSON.load, which can instantiate classes named in json_class when they define json_create. Write access to the memcached instance is enough to use either path, leading to unsafe deserialization, even when the call sets raw: true or serializer: JSON. The fix applies raw: true on every read that accepts options and adds a Dalli::JSONSerializer that only returns plain JSON types.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you rely on per request raw: true reads or the serializer: JSON option with a json gem older than 3.0.