CVE-2026-50052

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-50052
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50052.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-50052
Downstream
Related
Published
2026-06-03T03:56:01.974Z
Modified
2026-07-08T08:11:29.895751988Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/S:N/AU:N/R:A/V:D/RE:L/U:Green CVSS Calculator
Summary
[none]
Details

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/50xxx/CVE-2026-50052.json",
    "cwe_ids": [
        "CWE-444"
    ],
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/varnish/varnish

Affected ranges

Type
GIT
Repo
https://github.com/varnish/varnish
Events
Introduced
ce1b315b0c35477c666e4c8d8e1c9174df87eb61
Last affected
ce1b315b0c35477c666e4c8d8e1c9174df87eb61
Last affected
dc27a2dce662015cf79bbda5ff193b6bb74ba2d1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4883a9619d9fcdc4efcd7e4cd7e355ee38521a84
Last affected
04286a233e14a5674f86118da1c52ab63152006c
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "9.0.0"
        },
        {
            "last_affected": "9.0.0"
        },
        {
            "last_affected": "9.0.2"
        },
        {
            "introduced": "7.6.0"
        },
        {
            "last_affected": "8.0.1"
        },
        {
            "introduced": "6.0.14"
        },
        {
            "last_affected": "6.0.17"
        }
    ]
}

Affected versions

9.*
9.0.0
varnish-6.*
varnish-6.0.17
varnish-8.*
varnish-8.0.1
varnish-9.*
varnish-9.0.0
varnish-9.0.1
varnish-9.0.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-50052.json"