Vinyl Cache CVE-2026-50052

Exploitation requires that the +http2 feature flag is explicitly present in the Varnish or Vinyl Cache configuration; HTTP/2 support is disabled by default and must be affirmatively opted into, making this a non-default configuration prerequisite. Per the CVSS 4.0 vector, no authentication is required (PR:N), meaning an unauthenticated external attacker can initiate the attack if the configuration condition is met. High attack complexity (AC:H) and partial attack target (AT:P) confirm that the attacker must craft malformed HTTP/2 frames with precision and that the specific deployment condition (HTTP/2 enabled) is mandatory for any exploitation path to exist. Passive user interaction (UI:P) indicates that a legitimate client request must be present or actively in-flight against the cache for the desync to succeed. Exploitation is further constrained to specific version ranges across three CPE lineages, and the absence of public exploit tooling reduces the realistic attacker pool to those with deep HTTP/2 parsing knowledge. Default installations with HTTP/2 not enabled are not affected.

The CVSS 4.0 score of 2.3 with a Green urgency designation reflects several concurrently risk-reducing factors: AC:H (high complexity requiring precisely crafted HTTP/2 frames), AT:P (partial attack target, contingent on non-default HTTP/2 configuration), UI:P (passive user interaction required - a legitimate in-flight client request must be present), and constrained direct impact on the vulnerable system (VC:L/VI:N/VA:N). Despite the low score, the downstream consequences of a successful HTTP request smuggling attack - cache poisoning serving malicious responses to large numbers of users, authentication bypass, and information disclosure - can meaningfully exceed what a 2.3 CVSS score implies for organizations that have explicitly enabled HTTP/2. SSVC supplemental signals further confirm low urgency: Automatable is No (AU:N), Recovery is Automatic (R:A), and Value Density is Diffuse (V:D), collectively indicating this is not a viable mass-exploitation scenario. The EPSS score is not provided in the available data, which limits probabilistic exploitation forecasting. The core tension in this CVE is that the CVSS score accurately reflects difficulty and prerequisite conditions, while the ENISA tags (Authentication Bypass, Information Disclosure, Request Smuggling) accurately reflect the potential downstream severity - organizations running HTTP/2-enabled deployments should treat this as higher priority than the raw score suggests.

An unauthenticated remote attacker identifying a deployment with HTTP/2 explicitly enabled on Varnish or Vinyl Cache constructs a precisely crafted HTTP/2 request that exploits the parser's handling of request framing, causing the backend origin server to interpret a hidden attacker-controlled second request embedded within the byte stream. The smuggled request could be structured to poison the cache with a malicious response that is subsequently served to many legitimate users, or to inject a request that appears to the backend as internally originating - bypassing authentication middleware that operates above the cache layer. No public proof-of-concept code has been identified at time of analysis, and successful exploitation requires both the non-default HTTP/2 configuration and precise framing knowledge.