In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2…
Priority LOW 12CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed Vinyl Cache (The Vinyl Cache Project): 9.0.1Varnish Cache (pre split) (The Vinyl Cache Project): 8.0.2, 6.0.18+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Vinyl Cache Project | Vinyl Cache | 9.0.0 | 9.0.1 | Patch available | CNA |
| The Vinyl Cache Project | Varnish Cache (pre split) | 7.6.0 – 8.0.1; 6.0.14 – 6.0.17 | 8.0.2, 6.0.18 | Patch available | CNA |
| varnish-software | Varnish Cache by Varnish Software | 9.0.0 – 9.0.2 | 9.0.3 | Patch available | CNA |
- Vinyl Cache VendorThe Vinyl Cache Project Affected 9.0.0 Fixed in 9.0.1 Patch available CNA
- Varnish Cache (pre split) VendorThe Vinyl Cache Project Affected 7.6.0 – 8.0.1; 6.0.14 – 6.0.17 Fixed in 8.0.2, 6.0.18 Patch available CNA
- Varnish Cache by Varnish Software Vendorvarnish-software Affected 9.0.0 – 9.0.2 Fixed in 9.0.3 Patch available CNA
Remediation
- Fix · CNA Vinyl Cache (The Vinyl Cache Project) Fixed in 9.0.1
- Fix · CNA Varnish Cache (pre split) (The Vinyl Cache Project) Fixed in 8.0.2, 6.0.18
- Fix · CNA Varnish Cache by Varnish Software (Varnish Software) Fixed in 9.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-50052
- 2026-10-03 Alias added: GHSA-mwjg-3fm6-9v84
References
Sources
- CVE-2026-50052 · CVE Program
- CVE-2026-50052 · NVD
- FIRST EPSS
- GHSA-mwjg-3fm6-9v84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences