AIKIDO-2026-858017

dalli is vulnerable to Information Disclosure

Information DisclosureGHSA-m252-9cgf-vx2w Published 6 days ago

High Risk

This Affects:

dalli

4.1.0 - 4.3.6

Fixed in 4.3.7

5.0.0 - 5.0.9

Fixed in 5.0.10

5.1.0 - 5.1.3

Fixed in 5.1.4

5.2.0 - 5.2.1

Fixed in 5.2.2

Are you affected? Scan for Free

TL;DR

When a Dalli client is configured with a namespace, Client#perform replaces the caller's key with the already namespaced key and then retries that same call after a transient network error, re-applying the namespace so app:x becomes app:app:x. The retried operation then runs against the wrong key: a read can return another key's value and a write can overwrite a different key, affecting single key operations, single server get_multi, and get_with_metadata/fetch_with_lock. The fix has every retry attempt start again from the caller's original key.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and your client is configured with a namespace and requests can hit transient network errors that trigger a retry.