CVE-2026-50052
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited for backend request desync (request smuggling), leading to cache poisoning, authentication bypass, or information disclosure. The attack only works if HTTP/2 is enabled (disabled by default).
Risk Assessment
An attacker can remotely manipulate HTTP/2 traffic, potentially leading to cache poisoning, authentication bypass, or data disclosure.
Recommendation
Update Vinyl Cache to version 9.0.1 or later, and Varnish Cache to version 9.0.3 or later. If HTTP/2 is not required, keep it disabled.
Other vulnerabilities in Varnish Cache
See all- CVE-2026-40396Medium
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait until the session releases its worker thread (timeout_linger), and resume traffic before the session is closed (timeout_idle) by sending more than one request at once to trigger pipelining and workspace overflow. The vulnerability stems from a porting error of the non-blocking architecture from Varnish Enterprise.
- CVE-2026-40394Medium
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allow a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. During HTTP/2 upgrade, a buffer allocation splits the workspace, and the next fetch may run out of workspace.
- CVE-2026-34475Medium
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1. This may lead to cache poisoning or authentication bypass.
Original NVD description (English source)
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS