CVE-2026-50052 Other in Varnish Cache (pre split)
Attackers can exploit HTTP/2 request parsing flaws to perform request smuggling, leading to cache poisoning, authentication bypass, or information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50052?
CVE-2026-50052 is a low-severity vulnerability in The Vinyl Cache Project Varnish Cache (pre split), published on 3 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.
Weakness: CWE-444
Which versions are affected by CVE-2026-50052?
Linux distribution packages (1)
vinyl-cache openSUSE:Tumbleweed | All versions | 9.0.1-1.1 |
How do I fix CVE-2026-50052?
Upgrade to a fixed version.
Is CVE-2026-50052 being exploited?
There is no known exploitation of CVE-2026-50052 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-50052, GHSA-mwjg-3fm6-9v84, UBUNTU-CVE-2026-50052, openSUSE-SU-2026:11039-1.