CVE-2026-50052
Gravedad CVSS v4.0:
BAJA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
03/06/2026
Última modificación:
03/06/2026
Descripción
*** Pendiente de traducción *** In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync<br />
attack (request smuggling), which in turn can be used for cache poisoning,<br />
authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the<br />
feature parameter to contain +http2. HTTP/2 support is disabled by<br />
default.