VSV00020 Vinyl Cache / Varnish Cache VCL string methods workspace overflow

2026-09-16

CVE pending

A workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.

This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart.

Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, ..etc).

We recommend to upgrade to a version which is not affected, or to mitigate the issue in VCL, as detailed below.

Versions affected

  • All Vinyl Cache versions up to and including 9.0.1

  • All Varnish Cache versions by Varnish Software up to and including 9.0.3

  • Varnish Cache Releases from 6.3.0 up to and including 8.0.2

Versions not affected

  • Vinyl Cache 9.1.0 (released 2026-09-16)

  • Vinyl Cache 9.0.2 (released 2026-09-16)

  • Varnish Cache by Varnish Software 9.0.4 (released 2026-09-XX)

  • Vinyl Cache main branch at commit 90f5bacc14b2404e6cc349ba015f0f73b8515136 or later

  • Varnish Cache by Varnish Software main branch at commit c5078ae575201b05ae8674a90ddb19ffe7f4b439 or later

  • All Varnish Cache 6.0 LTS series

  • Varnish Enterprise by Varnish Software

VCL Mitigation

A simple mitigation for this vulnerability is to replace the .upper() and .lower() VCL type method calls by their respective vmod_std counterparts: std.toupper() and std.tolower().

Acknowledgements and credits

We thank Tristan Madani (Talence Security), for responsibly reporting this issue.

For the Vinyl Cache project, the issue has been handled by Walid Boudebouda of Varnish Software in collaboration with Nils Goroll of UPLEX and Poul-Henning Kamp.