CVE-2026-93894 Details
Description
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).
A buffer overflow vulnerability in the workspace has been identified in Vinyl Cache versions prior to 9.0.2 and Varnish Cache versions by Varnish Software prior to 9.0.4, as well as Varnish Cache releases from 6.3.0 up to and including 8.0.2. This vulnerability arises in the .upper() and .lower() string type methods of VCL, allowing for remote denial-of-service attacks by causing the child process to segfault or assert, leading to a restart. Exploitation requires knowledge of the VCL in use and the ability to craft a request with a string long enough to fill the remaining workspace at the call site, while staying within various request size limits.
Users are advised to upgrade to Vinyl Cache 9.1.0 or 9.0.2, or to Varnish Cache by Varnish Software 9.0.4. For Varnish Cache, versions 6.0 LTS series and Varnish Enterprise by Varnish Software are also not affected. As a VCL-specific mitigation, replace the .upper() and .lower() method calls with std.toupper() and std.tolower() respectively.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://vinyl-cache.org/security/VSV00020.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vinyl Cache | <= 9.0.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 19, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |