GHSA-5wpc-45jc-6ccc: 
Ruby Analyse et atténuation de la vulnérabilité

Summary

A malicious or compromised memcached server or intermediary can exhaust Dalli client resources or keep a TLS operation blocked beyond the configured socket_timeout.

Details

Four reply handling paths are affected:

1. Pipelined get_multi accumulates a header that never ends in CRLF without the 8 KiB limit used for ordinary reply lines.
2. A declared value length can cause an excessive read, up to memcached's 1 GiB item maximum, even when the default 1 MiB value_max_bytes limits writes.
3. Stats and quiet or bulk operations accept an unbounded number of complete replies while waiting for their terminator.
4. On Ruby 3.3 with its default OpenSSL gem, blocking TLS handshake and reply reads can exceed socket_timeout. The attacker must control the memcached endpoint or an intermediary able to alter its replies. Both meta and binary protocols are covered where supported; the unterminated text header applies to the meta protocol. The fix limits incoming value sizes and reply counts, bounds pipelined socket reads and headers, and enforces timeouts for blocking TLS operations.

Impact

Denial of service through excessive memory use, CPU use, or a stalled caller. We have not identified code execution or data disclosure from these issues.

Remediation

Upgrade to the patch release for your supported line: 3.2.16, 4.3.11, 5.0.15, 5.1.9, 5.2.9, or 5.3.3. Incoming values now default to the configured value_max_bytes limit (1 MiB by default). If your deployment stores larger values, set the new max_response_bytes option to the required positive byte count. Until an upgrade is available, restrict memcached connections and intermediaries to trusted infrastructure. Older unsupported release lines may also be affected.