CVE-2026-50052 json
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend req…
published 2026-06-03 5 mo ago modified 2026-07-22 3 mo ago also EUVD-2026-34066
- cvss
- 2.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 32%
- public exploits
- 0
- none known
Summary
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
Patch / fix
- The Vinyl Cache Project Vinyl Cache 9.0.1
- The Vinyl Cache Project Varnish Cache (pre split) 6.0.18, 8.0.2
- Varnish Software Varnish Cache by Varnish Software 9.0.3
- varnish Debian 13 7.7.0-3+deb13u1
debian advisories DEBIAN-CVE-2026-50052
- vinyl-cache openSUSE Tumbleweed 9.0.1-1.1
opensuse advisories openSUSE-SU-2026:11039-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Green |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Green |
Affected products
- The Vinyl Cache Project Vinyl Cache
- The Vinyl Cache Project Varnish Cache (pre split)
- Varnish Software Varnish Cache by Varnish Software
Classification
- Weakness
-
- CWE-444 Inconsistent Interpretation of HTTP Requests
References
Sources
- CVE List CVE-2026-50052
- NVD CVE-2026-50052
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.