AIKIDO-2026-771594

dalli is vulnerable to Race Condition

Race ConditionGHSA-w39f-xq2m-4g8x Published Oct 8, 2026

Medium Risk

This Affects:

dalli

3.0.0 - 3.2.12

Fixed in 3.2.13

4.0.0 - 4.3.6

Fixed in 4.3.7

5.0.0 - 5.0.8

Fixed in 5.0.9

5.1.0 - 5.1.2

Fixed in 5.1.3

5.2.0 - 5.2.0

Fixed in 5.2.1

Are you affected? Scan for Free

TL;DR

Dalli buffers request bytes in Ruby's IO write buffer, and quiet/multi blocks don't flush until they end, so a forked child inherits that buffer and Ruby flushes it when the child closes its socket even if the child never uses Dalli. A buffered write is applied twice, and a buffered non-quiet request leaves the parent's connection off by one reply, so a later read returns the previous key's value. With TLS, the child's close also sends close_notify on the shared connection and tears down the parent's session. The fix makes Dalli buffer requests itself in sync mode, discards a forked child's inherited buffer, and closes only the child's own file descriptor without a TLS shutdown.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your process forks while a thread uses a shared Dalli client, such as a pre-forking server or job runner.