CVE-2026-93894

Name of the Vulnerable Software and Affected Versions Vinyl Cache versions prior to 9.0.2

Description A workspace buffer overflow exists in the .upper() and .lower() string type methods of the VCL (Varnish Configuration Language). This issue can be leveraged as a remote denial of service (DoS) vector, causing the child process to segfault or assert, which subsequently triggers a restart. Successful exploitation requires knowledge of the active VCL and the ability to craft a request containing a string long enough to fill the remaining workspace at the call site without exceeding request size limits such as http req size and http req hdr len.

Recommendations Update to version 9.0.2 or later.