# CVE-2026-93894: Vinyl Cache VCL string methods workspace buffer overflow

Source: https://junglewise.ai/threats/cve-2026-93894-in-vinyl-cache-before-9-0-2-workspace-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-93894 · Severity: info · Published 2026-09-18

Vinyl Cache, a web caching and acceleration service, contains a buffer overflow vulnerability in its string processing methods (.upper() and .lower()). An attacker can craft specially-sized requests to trigger a denial of service by crashing the cache worker process, causing service interruptions and requiring manual restarts.

Vendors: [Varnish-Software](https://junglewise.ai/threats/vendors/varnish-software).

## Quick answers

**Is CVE-2026-93894 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-93894 being exploited in the wild.

**How severe is CVE-2026-93894?** Informational severity, published 18 September 2026.

**Which products and versions are affected?** Varnish-Software Varnish Cache up to and including 9.0.3; Vinyl Cache Project Vinyl Cache before 9.0.2.

**Is there a fix for CVE-2026-93894?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-93894 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-93894?** Check whether you run Varnish-Software Varnish Cache or Vinyl Cache Project Vinyl Cache at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A workspace buffer overflow exists in the VCL .upper() and .lower() string type methods, allowing an unauthenticated remote attacker to overflow the workspace by sending a crafted request with a string sized to consume remaining workspace while respecting request size limits. Successful exploitation causes the child process to segfault or assert and restart. Exploitation requires knowledge of the deployed VCL configuration and careful crafting of the payload to stay within multiple size constraints (http_req_size, http_req_hdr_len, etc.).

## Affected products

- Vinyl Cache Project Vinyl Cache before 9.0.2
- Varnish Software Varnish Cache up to and including 9.0.3

## Timeline

- 2026-09-18: disclosed: CVE-2026-93894 published

## References

- [https://vinyl-cache.org/security/VSV00020.html](https://vinyl-cache.org/security/VSV00020.html)