CVE-2026-93894
published 2026-09-18CVE-2026-93894: In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a…
PriorityP416low2.3CVSS 4.0
AVNACHATPPRLUINVCNVINVALSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUNRAVDRELUClear
EPSS
0.36%
28.3th percentile
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| varnish-software | varnish_cache | < c5078ae575201b05ae8674a90ddb19ffe7f4b439 | c5078ae575201b05ae8674a90ddb19ffe7f4b439 |
| varnish-software | varnish_cache | 6.3.0 – 8.0.2 | — |
| varnish-software | varnish_cache | >= 9.0.0 < 9.0.4 | 9.0.4 |
| vinyl-cache | vinyl_cache | < 9.0.2 | 9.0.2 |
| vinyl-cache | vinyl_cache | < 90f5bacc14b2404e6cc349ba015f0f73b8515136 | 90f5bacc14b2404e6cc349ba015f0f73b8515136 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Varnish Software Varnish Cache/Vinyl Cache up to 9.0.1 VCL upper/lower buffer overflow
vuldb·2026-09-18·CVSS 2.3
CVE-2026-93894 [LOW] Varnish Software Varnish Cache/Vinyl Cache up to 9.0.1 VCL upper/lower buffer overflow
A vulnerability was found in Varnish Software Varnish Cache and Vinyl Cache up to 9.0.1. It has been classified as problematic. Affected by this vulnerability is the function upper/lower of the component VCL. The manipulation leads to buffer overflow.
This vulnerability is referenced as CVE-2026-93894. Remote exploitation of the attack is possible. No exploit is available.
Upgrading the affected component is recommended.
GHSA
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.
ghsa_unreviewed·2026-09-18
CVE-2026-93894 [LOW] CWE-787 In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-18
Published