A malicious or compromised memcached server or intermediary can exhaust Dalli client resources or keep a TLS operation blocked beyond the configured socket_timeout.

Pipelined get_multi can accumulate a header with no terminating CRLF without the 8 KiB limit used for ordinary reply lines. A declared value length can cause an excessive read, up to memcached's 1 GiB item maximum, even when the default 1 MiB value_max_bytes limits writes. Stats and quiet or bulk operations accept an unbounded number of complete replies while waiting for their terminator. On Ruby 3.3 with its default OpenSSL gem, blocking TLS handshake and reply reads can exceed socket_timeout.

The attacker must control the memcached endpoint or an intermediary able to alter its replies. Both meta and binary protocols are covered where supported; the unterminated text header applies to the meta protocol. These issues can cause denial of service through memory use, CPU use, or a stalled caller.

Upgrade to the patch release for your supported line. Incoming values now default to the configured value_max_bytes limit (1 MiB by default). If your deployment stores larger values, set max_response_bytes to the required positive byte count.

Workaround

Restrict memcached connections and intermediaries to trusted infrastructure until you can upgrade.