Vinyl Cache
Monthly
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12 mishandle HTTP/1.1 URLs with a root path (/) in unchecked req.url scenarios, enabling cache poisoning and authentication bypass attacks. Unauthenticated remote attackers can exploit this with moderate complexity to poison cached content or bypass authentication controls affecting downstream clients. No active exploitation has been confirmed, though the vulnerability carries a 5.4 CVSS score reflecting network accessibility and partial impact to confidentiality and integrity.
Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.
HTTP/2 request parsing in Vinyl Cache and Varnish Cache enables backend request desync (HTTP request smuggling), exploitable for cache poisoning, authentication bypass, and information disclosure against affected deployments. Vinyl Cache prior to 9.0.1 and Varnish Cache prior to 9.0.3, plus legacy pre-split Varnish Cache branches spanning versions 6.0.14 through 8.0.1, are confirmed affected across three distinct CPE lineages. Exploitation is gated behind an explicitly non-default configuration - HTTP/2 must be enabled via the +http2 feature parameter - which substantially limits exposure; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12 mishandle HTTP/1.1 URLs with a root path (/) in unchecked req.url scenarios, enabling cache poisoning and authentication bypass attacks. Unauthenticated remote attackers can exploit this with moderate complexity to poison cached content or bypass authentication controls affecting downstream clients. No active exploitation has been confirmed, though the vulnerability carries a 5.4 CVSS score reflecting network accessibility and partial impact to confidentiality and integrity.
Denial of service in Vinyl Cache releases before 9.0.2 (and in the related Varnish Cache lineage, per the affected CPEs): when the deployed VCL calls the .upper() or .lower() string methods on an attacker-influenced value, a carefully sized request string can overrun the remaining worker-thread workspace at that call site, causing the child process to segfault or trip an assertion and then restart. Reachability is gated by a non-default prerequisite - the VCL must actually apply these methods to request-derived data - and the attacker must know that VCL logic well enough to size the string to land in the narrow window between filling the remaining workspace and the http_req_size / http_req_hdr_len request limits, so this is a deliberately low-priority memory-corruption issue rather than a general-purpose remote attack. No public exploit code has been identified at time of analysis, and the impact is a transient, self-healing outage rather than a persistent one, with no effect on confidentiality or integrity.
HTTP/2 request parsing in Vinyl Cache and Varnish Cache enables backend request desync (HTTP request smuggling), exploitable for cache poisoning, authentication bypass, and information disclosure against affected deployments. Vinyl Cache prior to 9.0.1 and Varnish Cache prior to 9.0.3, plus legacy pre-split Varnish Cache branches spanning versions 6.0.14 through 8.0.1, are confirmed affected across three distinct CPE lineages. Exploitation is gated behind an explicitly non-default configuration - HTTP/2 must be enabled via the +http2 feature parameter - which substantially limits exposure; no public exploit code and no CISA KEV listing have been identified at time of analysis.