AIKIDO-2026-876017

TL;DR

Dalli's meta protocol rejected only CR, LF, and NUL in routing tokens, so a token containing spaces could add arbitrary meta flags to a command and let a user controlled key change an item's TTL, create a stub item on a miss, or read a different key. Failed requests also retried without limit because a successful reconnect reset the failure counter before socket_max_failures was reached, so a server that accepted connections but never replied could hang a request forever. Exceptions raised by application code inside a get_multi block were caught by the same rescue as socket errors and retried the whole call. The fix rejects whitespace and control characters in routing tokens, resets the failure count only when a request completes, and stops catching the caller's own exceptions.