PT-2026-45903 · Varnish · Vinyl Cache+1

Lam Jun Rong · CVE-2026-50052 · Published 2026-06-03 · Updated 2026-07-01

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Vinyl Cache versions prior to 9.0.1 Varnish Cache versions prior to 9.0.3

Description A deficiency in HTTP/2 request parsing allows for a backend request desync attack, also known as request smuggling. This can lead to cache poisoning, authentication bypass, information disclosure, or data manipulation. This issue is only exploitable if HTTP/2 support is enabled by configuring the feature parameter to include +http2. By default, HTTP/2 support is disabled.

Recommendations Update Vinyl Cache to version 9.0.1 or later. Update Varnish Cache to version 9.0.3 or later. As a temporary mitigation, ensure that the feature parameter does not contain +http2 to keep HTTP/2 support disabled.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-50052

OPENSUSE-SU-2026:11039-1

Affected Products

Varnish Cache

Vinyl Cache

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50052.json · Exploit
• https://cve.org/CVERecord?id=CVE-2026-50052 · Security Note
• https://ubuntu.com/security/CVE-2026-50052 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-50052 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-50052 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:11039-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50052 · Security Note
• https://osv.dev/vulnerability/CVE-2026-50052 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-50052 · Vendor Advisory
• https://github.com/varnish/varnish · Note
• https://suse.com/security/cve/CVE-2026-50052 · Note
• https://code.vinyl-cache.org/vinyl-cache/vinyl-cache · Note
• https://twitter.com/calif_io/status/2072329095757893822 · Twitter Post
• https://vinyl-cache.org/security/VSV00019.html · Note
• https://twitter.com/VulmonFeeds/status/2062061829472297242 · Twitter Post