PT-2026-45903

CVE-2026-50052

Published

2026-06-03

Updated

2026-07-01

Description by

CVSS 4.0

2.3

Low

MetricsAV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Green

Name of the Vulnerable Software and Affected Versions Vinyl Cache versions prior to 9.0.1 Varnish Cache versions prior to 9.0.3

Description A deficiency in HTTP/2 request parsing allows for a backend request desync attack, also known as request smuggling. This can lead to cache poisoning, authentication bypass, information disclosure, or data manipulation. This issue is only exploitable if HTTP/2 support is enabled by configuring the feature parameter to include +http2. By default, HTTP/2 support is disabled.

Recommendations Update Vinyl Cache to version 9.0.1 or later. Update Varnish Cache to version 9.0.3 or later. As a temporary mitigation, ensure that the feature parameter does not contain +http2 to keep HTTP/2 support disabled.

Exploitability

Exploit

Fix

Impacts

Researchers

Lam Jun Rong

Vendors

Affected products

Weakness enumeration

CWE-444: Inconsistent Interpretation of HTTP Requests (\'HTTP Request/Response Smuggling\')

Related identifiers

CVE-2026-50052