CVE-2026-50052: Vinyl Cache / Varnish Cache HTTP/2 parsing deficiency [CVE-2026-50052]
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Vinyl Cache / Varnish Cacheto a version that resolves this vulnerability.Fixed in 9.0.1 - Upgrade
Upgrade
Vinyl Cache / Varnish Cacheto a version that resolves this vulnerability.Fixed in 9.0.3 - Configuration
Ensure HTTP/2 support is disabled by removing '+http2' from the feature parameter (attack exists only when HTTP/2 is enabled via '+http2').
Vinyl Cache / Varnish Cache HTTP/2 support feature parameter = contain +http2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-50052?
CVE-2026-50052 has a severity level of low with a CVSS score of 4.0.
How do I fix CVE-2026-50052?
To remediate CVE-2026-50052, you should update to Vinyl Cache version 9.0.1 or later and Varnish Cache version 9.0.3 or later.
What vulnerabilities are associated with CVE-2026-50052?
CVE-2026-50052 can lead to cache poisoning, authentication bypass, and potential information disclosure due to request smuggling.
What software is affected by CVE-2026-50052?
CVE-2026-50052 affects Vinyl Cache versions before 9.0.1 and Varnish Cache versions before 9.0.3.
What type of attack does CVE-2026-50052 facilitate?
CVE-2026-50052 facilitates backend request desynchronization attacks, commonly known as request smuggling.