Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN915
_____________________________________________________________________

DATE                : 21/09/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S):  Systems running Vinyl Cache versions prior to
                       9.1.0, 9.0.2, main branch at commit
                         90f5bacc14b2404e6cc349ba015f0f73b8515136,
                      Varnish Cache versions prior to 9.0.4, 
     main branch at commit c5078ae575201b05ae8674a90ddb19ffe7f4b439,
                      6.0 LTS series.
  
=====================================================================
https://vinyl-cache.org/security/VSV00020.html
_____________________________________________________________________

VSV00020 Vinyl Cache / Varnish Cache VCL string methods workspace
overflow


2026-09-16

CVE pending

A workspace buffer overflow vulnerability was found in the .upper()
and .lower() string type methods of VCL.

This can be used as a remote denial of service (DoS) vector to make
the child process segfault or assert, and then restart.

Effectively exploiting this vulnerability requires prior knowledge
about the VCL in use and the ability to craft a request that
contains a string that is long enough to fill the remaining workspace
at the call site while staying under the different request size
limits (http_req_size, http_req_hdr_len, ..etc).

We recommend to upgrade to a version which is not affected, or to
mitigate the issue in VCL, as detailed below.


Versions affected

    All Vinyl Cache versions up to and including 9.0.1

    All Varnish Cache versions by Varnish Software up to and
including 9.0.3

    Varnish Cache Releases from 6.3.0 up to and including 8.0.2

Versions not affected

    Vinyl Cache 9.1.0 (released 2026-09-16)

    Vinyl Cache 9.0.2 (released 2026-09-16)

    Varnish Cache by Varnish Software 9.0.4 (released 2026-09-16)

    Vinyl Cache main branch at commit 90f5bacc14b2404e6cc349ba015f0f73b8515136 or later

    Varnish Cache by Varnish Software main branch at commit c5078ae575201b05ae8674a90ddb19ffe7f4b439 or later

    All Varnish Cache 6.0 LTS series

    Varnish Enterprise by Varnish Software


VCL Mitigation

A simple mitigation for this vulnerability is to replace the
.upper() and .lower() VCL type method calls by their respective
vmod_std counterparts: std.toupper() and std.tolower().


Acknowledgements and credits

We thank Tristan Madani (Talence Security), for responsibly
reporting this issue.

For the Vinyl Cache project, the issue has been handled by
Walid Boudebouda of Varnish Software in collaboration with
Nils Goroll of UPLEX and Poul-Henning Kamp.

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================