I found a similar vulnerability in Django's Memcache integration – a space character in a key could cause a failure to read which could lead to an incomplete read, and subsequent reads on the same connection reading data they shouldn't. We never used it in a way that could have led to data being leaked, but that's not generally true. (Also credit to the Django project for their exceptional handling of the vulnerability reporting process)

It turns out that if you put control signals in-band in the data channel, it's extremely hard to get right, and can easily lead to issues like this if connections aren't managed very carefully. One could make a comparison to how LLMs work at the moment too, it feels like a related class of vulnerability to me.