Vinyl-cache vulnerabilities
We track 3 vulnerabilities in Vinyl-cache products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on April 12, 2026.
Latest Vinyl-cache vulnerabilities
- 7.5 High severity
Varnish Cache: Always-Incorrect Control Flow Implementation
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic
- 7.5 High severity
Varnish Cache: Always-Incorrect Control Flow Implementation
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgr
- 9.8 Critical severity
Varnish Cache: Incorrect Behavior Order: Validate Before Canonicalize
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.