Skip to main content

Vinyl Cache EUVDEUVD-2026-83400

| CVE-2026-93894 LOW
Out-of-bounds Write (CWE-787)
2026-09-18 mitre GHSA-pfj3-384h-g8q8
Buffer Overflow Denial Of Service Memory Corruption Varnish Cache Vinyl Cache Varnish Software
2.3
CVSS 4.0 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY
2.3 LOW
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:L/U:Clear
vuln.today AI
3.7 LOW

Remote and unauthenticated (the 'VCL knowledge' is reconnaissance, not privilege), but AC:H because it needs a specific non-default VCL feature and precise payload sizing; only transient availability impact (A:L) due to auto-restart.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Sep 18, 2026 - 21:18 EUVD
Analysis Generated
Sep 18, 2026 - 21:10 vuln.today
CVE Published
Sep 18, 2026 - 20:30 cve.org
LOW 2.3

DescriptionCVE.org

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).

AnalysisAI

Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a NON-DEFAULT prerequisite: the deployed VCL must call the .upper() or .lower() string methods on an attacker-controllable value (e.g., a header or request component). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuinely low-priority issue despite being a memory-corruption (CWE-787) flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Vinyl Cache 9.0.2, which is the vendor-released patched version identified in the advisory VSV00020 (https://vinyl-cache.org/security/VSV00020.html); confirm the build you run corresponds to 9.0.2 or later by checking the reported version from the CLI/admin interface after upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Varnish Cache

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2017-8807 CRITICAL
9.1 Nov 16

vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows r
CVE-2013-4484 MEDIUM POC
5.0 Nov 01

Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching out
CVE-2015-8852 HIGH
7.5 Apr 25

Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP h
CVE-2017-12425 HIGH
7.5 Aug 04

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2.

CVE-2022-45060 HIGH
7.5 Nov 09

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x bef
CVE-2022-45059 HIGH
7.5 Nov 09

An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. Rated high severity (CVSS 7.5), this v
CVE-2022-38150 HIGH
7.5 Aug 11

In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically

CVE-2021-28543 HIGH
7.5 Mar 16

Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some conf
CVE-2020-11653 HIGH
7.5 Apr 08

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. Rated h
CVE-2019-15892 HIGH
7.5 Sep 03

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. Rated high severity (CVSS 7
CVE-2021-36740 MEDIUM
6.5 Jul 14

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length hea

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Share

EUVD-2026-83400 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy