« Volver al listado

CVE-2026-50052

Estado: Pendiente de análisisBaja (2.3)—

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Varnish — Varnish CacheAIVinyl-cache — Vinyl CacheAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-50052",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50052",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T13:27:03.836713Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "Safety": "NEGLIGIBLE",
          "version": "4.0",
          "Recovery": "AUTOMATIC",
          "baseScore": 2.3,
          "Automatable": "NO",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "DIFFUSE",
          "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:A/V:D/RE:L/U:Green",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "GREEN",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "LOW",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "repo": "https://code.vinyl-cache.org/vinyl-cache/vinyl-cache",
          "vendor": "The Vinyl Cache Project",
          "product": "Vinyl Cache",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0"
            },
            {
              "status": "unaffected",
              "version": "9.0.1"
            }
          ],
          "programFiles": [
            "bin/vinyld/http2/cache_http2_hpack.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://code.vinyl-cache.org/vinyl-cache/vinyl-cache",
          "vendor": "The Vinyl Cache Project",
          "product": "Varnish Cache (pre split)",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "8.0.1"
            },
            {
              "status": "unaffected",
              "version": "8.0.2"
            },
            {
              "status": "affected",
              "version": "6.0.14",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.17"
            },
            {
              "status": "unaffected",
              "version": "6.0.18"
            }
          ],
          "programFiles": [
            "bin/varnishd/http2/cache_http2_hpack.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://github.com/varnish/varnish",
          "vendor": "Varnish Software",
          "product": "Varnish Cache by Varnish Software",
          "versions": [
            {
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "9.0.2"
            },
            {
              "status": "unaffected",
              "version": "9.0.3"
            }
          ],
          "programFiles": [
            "bin/vinyld/http2/cache_http2_hpack.c"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-03T06:16:35.390",
  "references": [
    {
      "url": "https://vinyl-cache.org/security/VSV00019.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/01/9",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync\nattack (request smuggling), which in turn can be used for cache poisoning,\nauthentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the\nfeature parameter to contain +http2. HTTP/2 support is disabled by\ndefault."
    },
    {
      "lang": "es",
      "value": "En Vinyl Cache anterior a 9.0.1 y Varnish Cache anterior a 9.0.3, una deficiencia en el análisis de solicitudes HTTP/2 puede ser explotada para lanzar un ataque de desincronización de solicitudes de backend (contrabando de solicitudes), que a su vez puede ser utilizado para envenenamiento de caché, omisión de autenticación, o posiblemente incluso revelación y manipulación de información. El vector de ataque solo existe si el soporte HTTP/2 está habilitado configurando el parámetro feature para que contenga +http2. El soporte HTTP/2 está deshabilitado por defecto."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "cve@mitre.org"
}