====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN712
_____________________________________________________________________


DATE                : 02/07/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Vinyl Cache versions prior to 
9.0.1, main branch at commit dfc27fb4e7bf110945f5c145ce95b8de14ead77f,
          Varnish Cache by Varnish Software versions prior to 9.0.3,
                  Varnish Cache versions prior to 8.0.2, 6.0.18.
 
====================================================================
https://vinyl-cache.org/security/VSV00019.html
_____________________________________________________________________


VSV00019 Vinyl Cache / Varnish Cache HTTP/2 parsing deficiency

Originally published 2026-05-18, last updated 2026-06-28

CVE-2026-50052

A deficiency in HTTP/2 request parsing can be exploited to launch a
backend request desync attack (request smuggling), which in turn can
be used for cache poisoning, authentication bypass or possibly even
information disclosure and manipulation.

The attack vector only exists if HTTP/2 support is enabled by setting
the feature parameter to contain +http2. HTTP/2 support is disabled
by default.

We recommend to upgrade to a version which is not affected, to disable
HTTP/2 support or to mitigate the issue in VCL, as detailed below.


Versions affected

    Vinyl Cache 9.0.0

    Varnish Cache by Varnish Software up to and including 9.0.2

    All Varnish Cache Releases from 7.6.0 up to and including 8.0.1

    Varnish Cache 6.0 LTS series from 6.0.14 up to and including 6.0.17.

Versions not affected

    Vinyl Cache 9.0.1 (released 2026-05-18)

    Vinyl Cache main branch at commit dfc27fb4e7bf110945f5c145ce95b8de14ead77f or later

    Varnish Cache by Varnish Software 9.0.3 (released 2026-05-18)

    Varnish Cache 8.0.2 (released 2026-05-18)

    Varnish Cache 6.0 LTS version 6.0.18 (2026-05-18)

    Varnish Enterprise by Varnish Software


Mitigation Options

Several options to mitigate this issue exist. The safest is disabling
HTTP/2.


Disable HTTP/2

The vulnerability can only be exploited if HTTP/2 support is enabled. Where
it is, it can be disabled

    at runtime by issuing vinyladm param.set feature -http2

    persistently by removing -p feature=+http2 from the vinyld startup
parameters

Note that HTTP/2 typically requires a TLS offloader, which must be changed
to no longer send the h2 ALPN. For example with haproxy, in the listen/bind
configuration directive, alpn h2,http/1.1 should be replaced with alpn
http/1.1.


In VCL, add a vmod re2 header filter

This method requires vmod_re2.

vmod_re2 header filters (see the tutorial for more information) can be used
to remove injected invalid header lines, which are the vehicle required for
launching desync attacks exploiting this vulnerability.

To the best of our knowledge, the following VCL snippet at the top of the
custom VCL adds protection by removing invalid headers:

## BEGIN vsv19 mitigation
#
import re2;
sub vcl_init {
        new sane = re2.set(anchor=start, case_sensitiveúlse);
        # https://httpwg.org/specs/rfc9110.html#rule.token.separators
        # SLIGHTLY more relaxed, because it allows trailing SP / HTAB
        sane.add("[-!#$%&'*+.^_`|~a-z0-9]+:[\s\x21-\x7E\x80-\xff]+$");
}
sub vcl_recv {
        sane.hdr_filter(req, true);
}
#
## END vsv19 mitigation

To the best of our knowledge, where vmod_re2 is already used with a
hdr_filter in allow mode (second argument true), protection is already
sufficient unless the empty string is allowed.
In VCL, close desync

This method requires no additional VMODs. It works by combining two
techniques:

    rendering a smuggled request invalid

    avoiding backend connection reuse.

The VCL differs for Vinyl Cache / Varnish Cache >= 7.6.0 and Varnish
Cache 6.0.


>= 7.6.0 plain VCL mitigation

For versions 7.6.0 and higher, this method requires no additional VMODs,
but needs inline-C to be enabled.

For Vinyl Cache:

    at runtime by issuing vinyladm param.set vcc_feature +allow_inline_c

    persistently by adding -p vcc_feature=+allow_inline_c to the vinyld
startup parameters


For Varnish Cache:

    at runtime by issuing varnishadm param.set vcc_feature +allow_inline_c

    persistently by adding -p vcc_feature=+allow_inline_c to the varnishd
startup parameters

Besides enabling inline-C, the following snippet needs to be added at the
top of the custom VCL:

## BEGIN vsv19 mitigation
#
sub recv_vsv19 {
        unset req.http.vsv19;
        if (req.proto != "HTTP/2.0" || ! req.http.content-length) {
                return;
        }
        set req.http.vsv19 = "1";
        C{
                VRT_SetHdr(ctx, &VGC_HDR_REQ_content_2d_length, 0,
                        TOSTRAND(VRT_GetHdr(ctx, &VGC_HDR_REQ_content_2d_length)));
        }C
}
sub vcl_recv {
        call recv_vsv19;
}
sub vcl_backend_fetch {
        if (bereq.http.vsv19) {
                set bereq.http.Connection = "close";
        }
}
#
## END vsv19 mitigation

In addition, care must be taken that bereq.http.Connection is not unset
anywhere else in the custom VCL.


6.0 plain VCL mitigation

For version 6.0 LTS, this method works in pure VCL with no other changes
required. The following snippet needs to be added at the top of the
custom VCL:

## BEGIN vsv19 mitigation
#
sub recv_vsv19 {
        unset req.http.vsv19;
        if (req.proto != "HTTP/2.0" || ! req.http.content-length) {
                return;
        }
        set req.http.vsv19 = "1";
        set req.http.content-length = req.http.content-length;
}
sub vcl_recv {
        call recv_vsv19;
}
sub vcl_backend_fetch {
        if (bereq.http.vsv19) {
                set bereq.http.Connection = "close";
        }
}
#
## END vsv19 mitigation

In addition, care must be taken that bereq.http.Connection is not unset
anywhere else in the custom VCL.


Acknowledgements and credits

We thank Lam Jun Rong of Calif.io, who used Anthropic Research’s tool
“Claude”, for reporting this issue.

For the Vinyl Cache project, the issue has been handled by Nils Goroll
of UPLEX. The merged fix is a slight variation of the proposed fix by
Lam Jun Rong, which had already been found independently by Dridi
Boukelmoune.


Edits after initial publication

    2026-05-28 be more specific that the plain VCL mitigation is version
specific, add information for Varnish Cache

    2026-05-28 simplify the plain VCL mitigation

    2026-05-28 add 6.0 plain VCL mitigation


========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
========================================================