AIKIDO-2026-484713
dalli is vulnerable to Denial of Service (DoS)
55
Medium Risk
This Affects:
dalliTL;DR
Dalli inflated any value flagged as compressed with no size limit, so a roughly 130 KB stored item could expand to 128 MB on read regardless of client settings. It also used the size reported in a reply, such as a meta VA <size> or binary body length, to allocate or buffer that many bytes before validating it, so a hostile or compromised memcached server or proxy could make the client allocate gigabytes. With the fix, decompression is capped by a new decompressed_max_bytes option, 128 MiB by default, and reply sizes over memcached's 1 GiB item limit are rejected before they are read.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you store compressed values, or an untrusted or compromised memcached server or proxy can send replies to your client.
Background info
dalli is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 3.2.11, 4.0.0 - 4.3.5, 5.0.0 - 5.0.8, 5.1.0 - 5.1.2 and 5.2.0 - 5.2.0.
How to fix this
Upgrade the dalli library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.