PT-2026-45903 · Varnish · Varnish Cache+1

Lam Jun Rong · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-50052

Positive Technologies (AI Summary)

CVSS v4.0

2.3

Low

Base vector

AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Vinyl Cache versions prior to 9.0.1 Varnish Cache versions prior to 9.0.3

Description A deficiency in HTTP/2 request parsing allows for backend request desync attacks, also known as request smuggling. This occurs when the frontend and backend servers disagree on where a request ends, allowing an attacker to "smuggle" a request. This can lead to cache poisoning, authentication bypass, information disclosure, and data manipulation. The issue is only present if HTTP/2 support is enabled by configuring the feature parameter to include +http2. By default, this support is disabled.

Recommendations Update Vinyl Cache to version 9.0.1 or later. Update Varnish Cache to version 9.0.3 or later. As a temporary mitigation, ensure that HTTP/2 support is disabled by removing +http2 from the feature parameter.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-50052

Affected Products

Varnish Cache

Vinyl Cache

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-50052 · Security Note
• https://vinyl-cache.org/security/VSV00019.html · Note
• https://t.me/CVEtracker/55691 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2062061829472297242 · Twitter Post