p PatchFirst

CVE-2026-50052

CVE-2026-50052

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

CVSS 2.3 · Low · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • vinyl cache

    Versions
    • 9.0.0: Affected
    • 9.0.1: Not affected

    Update to 9.0.1

  • varnish cache (pre split)

    Versions
    • ≥ 7.6.0, ≤ 8.0.1: Affected (semver)
    • 8.0.2: Not affected
    • ≥ 6.0.14, ≤ 6.0.17: Affected (semver)
    • 6.0.18: Not affected

    Update to 6.0.18; Update to 8.0.2

  • varnish cache by varnish software

    Versions
    • ≥ 9.0.0, ≤ 9.0.2: Affected (semver)
    • 9.0.3: Not affected

    Update to 9.0.3

  • varnish Debian:13

    Versions
    • 7.7.0-3
    Affected ranges
    • ECOSYSTEM: < 7.7.0-3+deb13u1

    Update to 7.7.0-3+deb13u1

  • varnish Ubuntu:14.04:LTS

    Versions
    • 3.0.4-1ubuntu1
    • 3.0.4-1ubuntu2
    • 3.0.5-1ubuntu2
    • 3.0.5-2
    • 3.0.5-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:Pro:16.04:LTS

    Versions
    • 4.0.3-1
    • 4.1.0-1
    • 4.1.0-2
    • 4.1.1-1
    • 4.1.1-1ubuntu0.2
    • 4.1.1-1ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:Pro:18.04:LTS

    Versions
    • 5.0.0-7.1
    • 5.2.1-1
    • 5.2.1-1ubuntu0.1
    • 5.2.1-1ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:Pro:20.04:LTS

    Versions
    • 6.1.1-1
    • 6.2.1-2
    • 6.2.1-2ubuntu0.1~esm1
    • 6.2.1-2ubuntu0.1~esm2
    • 6.2.1-2ubuntu0.1
    • 6.2.1-2ubuntu0.2
    • 6.2.1-2ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:Pro:22.04:LTS

    Versions
    • 6.5.2-1
    • 6.6.1-1
    • 6.6.1-1ubuntu0.2
    • 6.6.1-1ubuntu0.2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:24.04:LTS

    Versions
    • 7.1.1-1.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:25.10

    Versions
    • 7.7.0-1
    • 7.7.0-2
    • 7.7.0-3
    • 7.7.3-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:26.10

    Versions
    • 7.7.3-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • varnish Ubuntu:26.04:LTS

    Versions
    • 7.7.3-1
    • 7.7.3-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →