--- title: GHSA-r47x-6p6r-mvcp (dalli): Keys created by incr or... description: A vulnerability in the Dalli memcached client lets attacker-controlled keys forge get_multi replies. Using incr or decr with an initial value on a key... canonical: https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GHSA-r47x-6p6r-mvcp (dalli): Keys created by incr or decr can forge get_multi replies | daily.dev og:description: A vulnerability in the Dalli memcached client lets attacker-controlled keys forge get_multi replies. Using incr or decr with an initial value on a key... og:url: https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro og:image: https://api.daily.dev/og/posts/8yTKUhXRO.png og:image:alt: GHSA-r47x-6p6r-mvcp (dalli): Keys created by incr or decr can forge get_multi replies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GHSA-r47x-6p6r-mvcp (dalli): Keys created by incr or decr can forge get_multi replies **[RUBYLAND](https://daily.dev/sources/rubyla)** · 2 min read · 0 upvotes · 0 comments ## Summary A vulnerability in the Dalli memcached client lets attacker-controlled keys forge get_multi replies. Using incr or decr with an initial value on a key containing CRLF causes memcached to echo raw bytes that split the get_multi reply parser, returning an attacker-chosen value for another requested key. That forged value can then be deserialized with Marshal by default. The bug affects the meta protocol in 3.2.0+, 4.x with protocol: :meta, and all of 5.x. Fixed versions are 3.2.14, 4.3.8, 5.0.11, 5.1.5 and 5.2.3, and add a verify_reply_keys option plus switch counter creation from auto-create to add. Rails' MemCacheStore already escapes such characters, and hashing untrusted keys before incr/decr is a workaround. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is GHSA-r47x-6p6r-mvcp in the dalli gem and how does it work? It is a vulnerability where keys created by incr or decr with an initial value can forge get_multi replies in the Dalli memcached client. When such a key contains CRLF, memcached echoes the raw bytes in mg replies, which splits Dalli's pipelined get_multi parser and lets an attacker-chosen value be returned for another requested key, potentially deserialized via Marshal by default. _Teams relying on Dalli and memcached caching can track advisories like this one on daily.dev._ ### Which versions of dalli fix the get_multi key forgery vulnerability? The fix lands in dalli 3.2.14, 4.3.8, 5.0.11, 5.1.5, and 5.2.3 and later. These versions create incr/decr counters with an add operation instead of auto-create, and add an opt-in verify_reply_keys option so multi-gets ignore replies for keys they did not request. _daily.dev helps developers keep patch versions like these straight across their dependencies._ ### How do I protect my Rails app from the dalli incr/decr key forgery bug if I can't upgrade yet? Keep untrusted input out of keys passed to incr or decr when using an initial value, for example by hashing the key, or avoid passing an initial value at all. Note that Rails' MemCacheStore already escapes whitespace, control, and non-ASCII characters in keys before they reach Dalli, which mitigates exposure. _Developers patching caching layers against disclosures like this one often follow the thread on daily.dev._ ## Similar posts on daily.dev - [GHSA-p6pm-ch9v-44vx \(dalli\): Pipelined get\_multi can return another key's value after an error reply](https://daily.dev/posts/ghsa-p6pm-ch9v-44vx-dalli-pipelined-get-multi-can-return-another-key-s-value-after-an-error-reply-lkdogwjhi) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-6wmv-xq9m-fmp7 \(dalli\): Memcached command injection through numeric arguments to incr/decr and fetch\_with\_lock](https://daily.dev/posts/ghsa-6wmv-xq9m-fmp7-dalli-memcached-command-injection-through-numeric-arguments-to-incr-decr-and--ltt1n3mey) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-m252-9cgf-vx2w \(dalli\): With a namespace, a retried request reads or writes a different key](https://daily.dev/posts/ghsa-m252-9cgf-vx2w-dalli-with-a-namespace-a-retried-request-reads-or-writes-a-different-key-zwp1ulm1t) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-3553-vcg5-72jw \(dalli\): Unbounded decompression and reply sizes allow memory exhaustion](https://daily.dev/posts/ghsa-3553-vcg5-72jw-dalli-unbounded-decompression-and-reply-sizes-allow-memory-exhaustion-8ykhzq2lz) · RUBYLAND · 0 upvotes · 0 comments - [GHSA-4qp6-2jcr-596v \(dalli\): Routing tokens can inject meta protocol flags, and failed requests can retry forever](https://daily.dev/posts/ghsa-4qp6-2jcr-596v-dalli-routing-tokens-can-inject-meta-protocol-flags-and-failed-requests-can--yxxailzsp) · RUBYLAND · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ruby](https://daily.dev/tags/ruby) [View this post on daily.dev](https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"GHSA-r47x-6p6r-mvcp (dalli): Keys created by incr or decr can forge get_multi replies","url":"https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro"},"datePublished":"2026-10-30T21:22:19.698Z","dateModified":"2026-10-30T21:22:48.330Z","description":"A vulnerability in the Dalli memcached client lets attacker-controlled keys forge get_multi replies. Using incr or decr with an initial value on a key...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5fa7bf38a8a9c178c1d458f9f735556c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"RUBYLAND","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"RUBYLAND","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/rubyla","url":"https://daily.dev/sources/rubyla"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ruby","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"RUBYLAND","item":"https://daily.dev/sources/rubyla"},{"@type":"ListItem","position":3,"name":"GHSA-r47x-6p6r-mvcp (dalli): Keys created by incr or decr can forge get_multi replies"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghsa-r47x-6p6r-mvcp-dalli-keys-created-by-incr-or-decr-can-forge-get-multi-replies-8ytkuhxro#faq","mainEntity":[{"@type":"Question","name":"What is GHSA-r47x-6p6r-mvcp in the dalli gem and how does it work?","acceptedAnswer":{"@type":"Answer","text":"It is a vulnerability where keys created by incr or decr with an initial value can forge get_multi replies in the Dalli memcached client. When such a key contains CRLF, memcached echoes the raw bytes in mg replies, which splits Dalli's pipelined get_multi parser and lets an attacker-chosen value be returned for another requested key, potentially deserialized via Marshal by default. Teams relying on Dalli and memcached caching can track advisories like this one on daily.dev."}},{"@type":"Question","name":"Which versions of dalli fix the get_multi key forgery vulnerability?","acceptedAnswer":{"@type":"Answer","text":"The fix lands in dalli 3.2.14, 4.3.8, 5.0.11, 5.1.5, and 5.2.3 and later. These versions create incr/decr counters with an add operation instead of auto-create, and add an opt-in verify_reply_keys option so multi-gets ignore replies for keys they did not request. daily.dev helps developers keep patch versions like these straight across their dependencies."}},{"@type":"Question","name":"How do I protect my Rails app from the dalli incr/decr key forgery bug if I can't upgrade yet?","acceptedAnswer":{"@type":"Answer","text":"Keep untrusted input out of keys passed to incr or decr when using an initial value, for example by hashing the key, or avoid passing an initial value at all. Note that Rails' MemCacheStore already escapes whitespace, control, and non-ASCII characters in keys before they reach Dalli, which mitigates exposure. Developers patching caching layers against disclosures like this one often follow the thread on daily.dev."}}]} ```