Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-50052

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

The Vinyl Cache Project Vinyl Cache

Default version status: unaffected

  • 9.0.0affected
  • 9.0.1unaffected

The Vinyl Cache Project Varnish Cache (pre split)

Default version status: unaffected

  • 7.6.0 to ≤ 8.0.1affected
  • 8.0.2unaffected
  • 6.0.14 to ≤ 6.0.17affected
  • 6.0.18unaffected

Varnish Software Varnish Cache by Varnish Software

Default version status: unaffected

  • 9.0.0 to ≤ 9.0.2affected
  • 9.0.3unaffected

References