Low
varnish, vinyl-cache — security advisory
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).
- Products
- varnish, vinyl-cache
- Affected versions
- 3.0.4-1ubuntu1, 3.0.4-1ubuntu2, 3.0.5-1ubuntu2, 3.0.5-2, 3.0.5-2ubuntu0.1, 4.0.3-1, 4.1.0-1, 4.1.0-2, 4.1.1-1, 4.1.1-1ubuntu0.2, 4.1.1-1ubuntu0.2+esm1, 5.0.0-7.1, 5.2.1-1, 5.2.1-1ubuntu0.1, 5.2.1-1ubuntu0.1+esm1, 6.1.1-1, 6.2.1-2, 6.2.1-2ubuntu0.1, 6.2.1-2ubuntu0.1~esm1, 6.2.1-2ubuntu0.1~esm2, 6.2.1-2ubuntu0.2, 6.2.1-2ubuntu0.2+esm1, 6.5.2-1, 6.6.1-1, 6.6.1-1ubuntu0.2, 6.6.1-1ubuntu0.2+esm1, 7.1.1-1.1ubuntu1, 7.7.3-1, 7.7.3-1build1, 9.0.1-4
- Fixed versions
- Not specified
- CVEs
- CVE-2026-93894
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:33 UTC · Revision 1
Source evidence
In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).
osv:UBUNTU-CVE-2026-93894
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
vinyl-cache
Fixed versions: Not specified
varnish
Fixed versions: Not specified
Complete source record
{
"id": "04f0d19fda4c4552f4b6c246729efd6ef7cdbf34578e1341d8fb564799662ee9",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-93894",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-93894",
"summary": "In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).",
"evidence": "osv:UBUNTU-CVE-2026-93894",
"products": [
{
"name": {
"value": "varnish",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.4-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.4-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.5-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.5-2ubuntu0.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.0.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1-1ubuntu0.2",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1-1ubuntu0.2+esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.0-7.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.1-1ubuntu0.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.1-1ubuntu0.1+esm1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.1.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.1~esm1",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.1~esm2",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.2+esm1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.5.2-1",
"evidence": "/affected/4/versions"
},
{
"value": "6.6.1-1",
"evidence": "/affected/4/versions"
},
{
"value": "6.6.1-1ubuntu0.2",
"evidence": "/affected/4/versions"
},
{
"value": "6.6.1-1ubuntu0.2+esm1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.1.1-1.1ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.7.3-1build1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "vinyl-cache",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "9.0.1-4",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.7.3-1",
"evidence": "/affected/8/versions"
},
{
"value": "7.7.3-1build1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "low",
"structured": {
"id": "UBUNTU-CVE-2026-93894",
"aliases": [
"UBUNTU-CVE-2026-93894"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/AU:N/R:A/V:D/RE:L/U:Clear"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"3.0.4-1ubuntu1",
"3.0.4-1ubuntu2",
"3.0.5-1ubuntu2",
"3.0.5-2",
"3.0.5-2ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi1",
"binary_version": "3.0.5-2ubuntu0.1"
},
{
"binary_name": "varnish",
"binary_version": "3.0.5-2ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"4.0.3-1",
"4.1.0-1",
"4.1.0-2",
"4.1.1-1",
"4.1.1-1ubuntu0.2",
"4.1.1-1ubuntu0.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi1",
"binary_version": "4.1.1-1ubuntu0.2+esm1"
},
{
"binary_name": "varnish",
"binary_version": "4.1.1-1ubuntu0.2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"5.0.0-7.1",
"5.2.1-1",
"5.2.1-1ubuntu0.1",
"5.2.1-1ubuntu0.1+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi1",
"binary_version": "5.2.1-1ubuntu0.1+esm1"
},
{
"binary_name": "varnish",
"binary_version": "5.2.1-1ubuntu0.1+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"6.1.1-1",
"6.2.1-2",
"6.2.1-2ubuntu0.1~esm1",
"6.2.1-2ubuntu0.1~esm2",
"6.2.1-2ubuntu0.1",
"6.2.1-2ubuntu0.2",
"6.2.1-2ubuntu0.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi2",
"binary_version": "6.2.1-2ubuntu0.2+esm1"
},
{
"binary_name": "varnish",
"binary_version": "6.2.1-2ubuntu0.2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"6.5.2-1",
"6.6.1-1",
"6.6.1-1ubuntu0.2",
"6.6.1-1ubuntu0.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi2",
"binary_version": "6.6.1-1ubuntu0.2+esm1"
},
{
"binary_name": "varnish",
"binary_version": "6.6.1-1ubuntu0.2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"7.1.1-1.1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.1.1-1.1ubuntu1"
},
{
"binary_name": "varnish",
"binary_version": "7.1.1-1.1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"7.7.3-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.7.3-1build1"
},
{
"binary_name": "varnish",
"binary_version": "7.7.3-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "vinyl-cache",
"purl": "pkg:deb/ubuntu/vinyl-cache?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"9.0.1-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvinylapi3",
"binary_version": "9.0.1-4"
},
{
"binary_name": "vinyl-cache",
"binary_version": "9.0.1-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"7.7.3-1",
"7.7.3-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93894.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.7.3-1build1"
},
{
"binary_name": "varnish",
"binary_version": "7.7.3-1build1"
}
]
}
}
],
"modified": "2026-10-17T13:01:18.642807236Z",
"provider": "osv",
"upstream": [
"CVE-2026-93894"
],
"references": [
"https://ubuntu.com/security/CVE-2026-93894",
"https://www.cve.org/CVERecord?id=CVE-2026-93894",
"https://vinyl-cache.org/security/VSV00020.html"
]
},
"related_cves": [
{
"value": "CVE-2026-93894",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 361606,
"published_at": "2026-09-18T21:18:00+00:00"
}