Add GHSA-m252-9cgf-vx2w for dalli, and update two dalli entries for 5.2.2/5.1.4/5.0.10/4.3.7/3.2.13

GHSA-wr87-m4jw-29x5 and GHSA-w39f-xq2m-4g8x: the first fixes were
incomplete; new patched versions and a note on what was missed.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: petergoldstein

gems/dalli/GHSA-m252-9cgf-vx2w.yml

@@ -0,0 +1,49 @@
+---
+gem: dalli
+ghsa: m252-9cgf-vx2w
+url: https://github.com/petergoldstein/dalli/security/advisories/GHSA-m252-9cgf-vx2w
+title: With a namespace, a retried request reads or writes a different key
+date: 2026-10-05
+description: |
+  When a client is configured with a `namespace`, a request that hits a
+  transient network error (a timeout, or a connection closed by memcached
+  or a proxy, such as stale connections after a memcached restart) was
+  retried with the namespace applied a second time, so `app:x` became
+  `app:app:x`. A retried read could return a different key's value, and a
+  retried write could overwrite a different key. Where cache keys include
+  user input, a user who can choose a key of the form `app:<something>`
+  can arrange for another user's retried read to return attacker-chosen
+  data.
+
+  Affected: every single-key operation since 5.0.3, single-server
+  `get_multi` since 5.1.0, and `get_with_metadata` and `fetch_with_lock`
+  since 4.1.0. Clients without a namespace are not affected, and 3.2.x is
+  not affected.
+
+  ### Workarounds
+
+  Don't configure a `namespace`; prefix keys in application code instead.
+unaffected_versions:
+  - "< 4.1.0"
+patched_versions:
+  - "~> 4.3.7"
+  - "~> 5.0.10"
+  - "~> 5.1.4"
+  - ">= 5.2.2"
+related:
+  url:
+    - https://github.com/petergoldstein/dalli/security/advisories/GHSA-m252-9cgf-vx2w
+    - https://github.com/petergoldstein/dalli/commit/61a9813
+    - https://rubygems.org/gems/dalli/versions/5.2.2
+    - https://github.com/petergoldstein/dalli/releases/tag/v5.2.2
+    - https://rubygems.org/gems/dalli/versions/5.1.4
+    - https://github.com/petergoldstein/dalli/releases/tag/v5.1.4
+    - https://rubygems.org/gems/dalli/versions/5.0.10
+    - https://github.com/petergoldstein/dalli/releases/tag/v5.0.10
+    - https://rubygems.org/gems/dalli/versions/4.3.7
+    - https://github.com/petergoldstein/dalli/releases/tag/v4.3.7
+notes: |
+  - No CVE in GHSA.
+     - "A CVE has been requested through GitHub but not yet
+        assigned, so the entry has no cve: field."
+  - No CVSS score in GHSA; GitHub severity is high.

gems/dalli/GHSA-w39f-xq2m-4g8x.yml

@@ -20,19 +20,29 @@ description: |
   Applications that fork while threads use a shared client are affected
   (pre-forking servers, job runners).
 
+  The first fix was incomplete on 4.3.6 and 3.2.12: when another
+  library's fork hook (such as connection_pool's, loaded before Dalli) ran
+  first in the child, the parent's TLS session could still be ended, and
+  4.3.6's write buffer kept a reference to the caller's value string with
+  the meta protocol. Both are fixed in 4.3.7 and 3.2.13.
+
   ### Workarounds
 
   Call `close` on Dalli clients before forking, outside any quiet block.
 patched_versions:
-  - "~> 3.2.12"
-  - "~> 4.3.6"
+  - "~> 3.2.13"
+  - "~> 4.3.7"
   - "~> 5.0.9"
   - "~> 5.1.3"
   - ">= 5.2.1"
 related:
   url:
     - https://github.com/petergoldstein/dalli/security/advisories/GHSA-w39f-xq2m-4g8x
     - https://github.com/petergoldstein/dalli/commit/62d5ad1
+    - https://rubygems.org/gems/dalli/versions/4.3.7
+    - https://github.com/petergoldstein/dalli/releases/tag/v4.3.7
+    - https://rubygems.org/gems/dalli/versions/3.2.13
+    - https://github.com/petergoldstein/dalli/releases/tag/v3.2.13
     - https://rubygems.org/gems/dalli/versions/5.2.1
     - https://github.com/petergoldstein/dalli/releases/tag/v5.2.1
     - https://rubygems.org/gems/dalli/versions/5.1.3

gems/dalli/GHSA-wr87-m4jw-29x5.yml

@@ -23,20 +23,37 @@ description: |
   to avoid unsafe deserialization. Patched versions add
   `Dalli::JSONSerializer`, which reads with `JSON.parse`.
 
+  The first fix (5.2.1, 5.1.3, 5.0.9, 4.3.6 and 3.2.12) was incomplete:
+  on 5.0, 4.3 and 3.2, `cas` and `cas!` (and `fetch_with_lock` on 5.0,
+  and on 4.3 with the meta protocol) still deserialized values read with
+  `raw: true`, and on every line but 3.2 a raw read still honored flags a
+  reply carried unasked. Both are fixed in 5.2.2, 5.1.4, 5.0.10, 4.3.7
+  and 3.2.13.
+
   ### Workarounds
 
   Use a serializer that only parses data, such as one wrapping
   `JSON.parse`, instead of `serializer: JSON`.
 patched_versions:
-  - "~> 3.2.12"
-  - "~> 4.3.6"
-  - "~> 5.0.9"
-  - "~> 5.1.3"
-  - ">= 5.2.1"
+  - "~> 3.2.13"
+  - "~> 4.3.7"
+  - "~> 5.0.10"
+  - "~> 5.1.4"
+  - ">= 5.2.2"
 related:
   url:
     - https://github.com/petergoldstein/dalli/security/advisories/GHSA-wr87-m4jw-29x5
     - https://github.com/petergoldstein/dalli/commit/8529428
+    - https://rubygems.org/gems/dalli/versions/5.2.2
+    - https://github.com/petergoldstein/dalli/releases/tag/v5.2.2
+    - https://rubygems.org/gems/dalli/versions/5.1.4
+    - https://github.com/petergoldstein/dalli/releases/tag/v5.1.4
+    - https://rubygems.org/gems/dalli/versions/5.0.10
+    - https://github.com/petergoldstein/dalli/releases/tag/v5.0.10
+    - https://rubygems.org/gems/dalli/versions/4.3.7
+    - https://github.com/petergoldstein/dalli/releases/tag/v4.3.7
+    - https://rubygems.org/gems/dalli/versions/3.2.13
+    - https://github.com/petergoldstein/dalli/releases/tag/v3.2.13
     - https://rubygems.org/gems/dalli/versions/5.2.1
     - https://github.com/petergoldstein/dalli/releases/tag/v5.2.1
     - https://rubygems.org/gems/dalli/versions/5.1.3