Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-50052

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:d992caf38c04f9ab9dcf6063568206325722c186942102f5cdee9eb58b174b10
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 3 assertions

{"defaultStatus":"unaffected","product":"Vinyl Cache","programFiles":["bin/vinyld/http2/cache_http2_hpack.c"],"repo":"https://code.vinyl-cache.org/vinyl-cache/vinyl-cache","vendor":"The Vinyl Cache Project","versions":[{"status":"affected","version":"9.0.0"},{"status":"unaffected","version":"9.0.1"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/affected/0

{"defaultStatus":"unaffected","product":"Varnish Cache by Varnish Software","programFiles":["bin/vinyld/http2/cache_http2_hpack.c"],"repo":"https://github.com/varnish/varnish","vendor":"Varnish Software","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"9.0.0","versionType":"semver"},{"status":"unaffected","version":"9.0.3"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/affected/2

{"defaultStatus":"unaffected","product":"Varnish Cache (pre split)","programFiles":["bin/varnishd/http2/cache_http2_hpack.c"],"repo":"https://code.vinyl-cache.org/vinyl-cache/vinyl-cache","vendor":"The Vinyl Cache Project","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"7.6.0","versionType":"semver"},{"status":"unaffected","version":"8.0.2"},{"lessThanOrEqual":"6.0.17","status":"affected","version":"6.0.14","versionType":"semver"},{"status":"unaffected","version":"6.0.18"}]}

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/affected/1

Affected products and versions

3 source assertions
{"defaultStatus":"unaffected","product":"Vinyl Cache","programFiles":["bin/vinyld/http2/cache_http2_hpack.c"],"repo":"https://code.vinyl-cache.org/vinyl-cache/vinyl-cache","vendor":"The Vinyl Cache Project","versions":[{"status":"affected","version":"9.0.0"},{"status":"unaffected","version":"9.0.1"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/affected/0
{"defaultStatus":"unaffected","product":"Varnish Cache by Varnish Software","programFiles":["bin/vinyld/http2/cache_http2_hpack.c"],"repo":"https://github.com/varnish/varnish","vendor":"Varnish Software","versions":[{"lessThanOrEqual":"9.0.2","status":"affected","version":"9.0.0","versionType":"semver"},{"status":"unaffected","version":"9.0.3"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/affected/2
{"defaultStatus":"unaffected","product":"Varnish Cache (pre split)","programFiles":["bin/varnishd/http2/cache_http2_hpack.c"],"repo":"https://code.vinyl-cache.org/vinyl-cache/vinyl-cache","vendor":"The Vinyl Cache Project","versions":[{"lessThanOrEqual":"8.0.1","status":"affected","version":"7.6.0","versionType":"semver"},{"status":"unaffected","version":"8.0.2"},{"lessThanOrEqual":"6.0.17","status":"affected","version":"6.0.14","versionType":"semver"},{"status":"unaffected","version":"6.0.18"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NEGLIGIBLE","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2.3,"baseSeverity":"LOW","privilegesRequired":"NONE","providerUrgency":"GREEN","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","valueDensity":"DIFFUSE","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Green","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrity…
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion
{"cweId":"CWE-444","description":"CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions
{"url":"http://www.openwall.com/lists/oss-security/2026/07/01/9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/adp/1/references/0
{"url":"https://vinyl-cache.org/security/VSV00019.html"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:ed90a57d87595a4d22c728a82ab8e36d2ca47fe3159bbfd53c9915876a9b592a · sha256:bd69628ac2420b96… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer