Riskcovery

CVE-2026-50052

State
Published
Severity
2.3 Low
Published
Jun 3, 2026
Updated
Jul 1, 2026
Reserved
Jun 3, 2026

Read the record on cve.org

Description

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

Scores

CVSSScoreVectorSource
4.02.3 LowCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Greenmitre

Weaknesses

  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected Products

ProductVersions
Vinyl CacheThe Vinyl Cache Project
  • 9.0.0Affected
  • 9.0.1Not affected
Varnish Cache (pre split)The Vinyl Cache Project
  • 7.6.0 through 8.0.1Affected
  • 8.0.2Not affected
  • 6.0.14 through 6.0.17Affected
  • 6.0.18Not affected
Varnish Cache by Varnish SoftwareVarnish Software
  • 9.0.0 through 9.0.2Affected
  • 9.0.3Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.