The flaw lies in the HTTP/2 request parsing logic of Vinyl Cache and Varnish Cache versions older than 9.0.1 and 9.0.3, respectively. It allows an attacker to craft malformed headers that are interpreted differently by the server and the upstream backend, creating a backend request desynchronization (request smuggling) vector. This can be leveraged to poison the cache, bypass authentication, or potentially disclose or manipulate sensitive information. The weakness is a classic instance of CWE‑444, where unsafe parsing of protocol parameters leads to disordered request handling.

Affected products include The Vinyl Cache Project’s Varnish Cache (pre split) and Vinyl Cache, and Varnish Software’s Varnish Cache. The vulnerability exists in all releases before Vinyl Cache 9.0.1 and before Varnish Cache 9.0.3. Importantly, the attack vector is active only when HTTP/2 support is enabled for the instance, which is disabled by default.

The CVSS score of 2.3 indicates low overall severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Because the flaw can only be exploited with HTTP/2 enabled, the immediate risk to systems that have left this feature disabled is low; however, any operational deployment enabling HTTP/2 presents a potential for a severe backend desync attack if a public exploit materializes.