CVE-2026-50052
LOW EPSS 23.4%
Published Jun 3, 20263w ago · Modified Jun 17, 20261w ago
2.3 CVSS 4.0
Published Jun 3, 2026 3w ago
Last Modified Jun 17, 2026 1w ago
Description
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Green Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction P
Scope N
Threat Intelligence
EPSS Exploit Probability
23.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-444
References 1
- vinyl-cache.org https://vinyl-cache.org/security/VSV00019.html
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.