Varnish Cache By Varnish Software
Approved changes feed: RSS · Atom
cpe:2.3:a:varnish_software:varnish_cache_by_varnish_software:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Varnish Software (d1aa31d0-944f-5603-88d1-00bdef2165ea) |
|---|---|
| Product | Varnish Cache By Varnish Software (7b3e34cf-be4f-5de5-992d-acfaee8b72a4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-50052 |
vulnerable | 2026-06-08 08:07:02.786719 |
Details available
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync
attack (request smuggling), which in turn can be used for cache poisoning,
authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the
feature parameter to contain +http2. HTTP/2 support is disabled by
default.
Published: 2026-06-03T03:56:01.974Z
Updated: 2026-07-01T19:33:49.932Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.