VulnSocial

CVE-2026-50052Patch

LOWCVSS 2.3 · LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-444

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 4 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 4 signals
  • General: 1 classified signal
  • Disclosure: 1 classified signal
  • Peaked 3d ago at 1 mentions (2026-06-03); latest day: 1
  • 4 total mentions across 4 days

Deep dive

Activity timeline4 mentions / 4d
00111Mentions · 2026-06-03: 1Mentions · 2026-06-05: 1Mentions · 2026-07-01: 1Mentions · 2026-07-05: 1Patch / Workaround · 2026-06-05: 1Patch / Workaround · 2026-07-05: 1Technical Details · 2026-06-03: 1Technical Details · 2026-06-05: 1Technical Details · 2026-07-01: 1Technical Details · 2026-07-05: 106-0306-0507-0107-05
Signal classification3 categories
Patch
250.0%
General
125.0%
Disclosure
125.0%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-06-031
General1
2026-06-051
Patch1
2026-07-011
Disclosure1
2026-07-051
Patch1
Full discourse4 posts
  • Calif@calif_io
    Disclosure

    MAD Bugs: My Cousin Vinyl (CVE-2026-50052) So the story went like this: Squid was bleeding from a 29-year-old heap overread in her default config. Naturally, she did the only sensible thing: she called her cousin, Vinyl. It turns out Vinyl also had a family problem of his own. https://blog.calif.io/p/mad-bugs-my-cousin-vinyl-cve-2026

    Post summary

    The post announces and describes CVE-2026-50052 as a 29‑year‑old heap overread vulnerability, but does not include PoC code, exploit tools, patch info, or active exploitation reports.

    2184714626.8K
    6.8K followersView on X
  • Open Source Security mailing list@oss_security
    Patch

    CVE-2026-50052: Vinyl Cache, Varnish Cache: HTTP/2 parsing deficiency https://www.openwall.com/lists/oss-security/2026/07/01/9 Desync attack (request smuggling) can be used for cache poisoning, authentication bypass, information disclosure and manipulation. Fixes released 2026-05-18. https://x.com/calif_io/status/2072329095757893822

    Post summary

    The post announces a CVE-2026-50052 HTTP/2 parsing flaw in Varnish/Vinyl Cache, details its potential impacts, and confirms that vendor patches were released on May 18, 2026, indicating a patch‑centric update.

    00042767
    4.7K followersView on X
  • BnSnK@BunSnack
    Patch

    Varnish Cache CVE-2026-50052: HTTP/2 request desync leads to request smuggling and cache poisoning. Only exploitable when +http2 feature is explicitly enabled (non-default). Patch to 9.0.1. https://nvd.nist.gov/vuln/detail/CVE-2026-50052

    Post summary

    The announcement details a Varnish Cache HTTP/2 request desynchronization flaw leading to smuggling and cache poisoning, and notes that a patch to version 9.0.1 is available.

    0002012
    6 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-50052 HTTP/2 Request Parsing Deficiency in Varnish Cache Before 9.0.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50052

    Post summary

    The text merely labels CVE-2026-50052 as an HTTP/2 request parsing deficiency in Varnish Cache versions prior to 9.0.3, with no further actionable information or evidence of exploitation.

    0000058
    4.0K followersView on X

Explore more

Back to dashboard