Varnish Software Varnish Cache/Vinyl Cache up to 9.0.1 VCL upper/lower buffer overflow

Summaryinfo

A vulnerability was found in Varnish Software Varnish Cache and Vinyl Cache up to 9.0.1. It has been declared as problematic. Affected by this issue is the function upper/lower of the component VCL. The manipulation results in buffer overflow. This vulnerability is identified as CVE-2026-93894. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Varnish Software Varnish Cache and Vinyl Cache up to 9.0.1. Affected is the function upper/lower of the component VCL. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on availability. CVE summarizes:

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).

The advisory is available at vinyl-cache.org. This vulnerability is traded as CVE-2026-93894 since 09/18/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 9.0.2 eliminates this vulnerability. Applying the patch 90f5bacc14b2404e6cc349ba015f0f73b8515136 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Varnish Software

Name

• Varnish Cache
• Vinyl Cache

Version

• 9.0.0
• 9.0.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion