CISA ADP Vulnrichment

Answer in brief

CVE-2026-93894 records a Unknown severity vulnerability in CISA ADP Vulnrichment. The current sources do not mark it as known exploited. The current feed maps Varnish-Software/Varnish Cache (generic), Vinyl-Cache/Vinyl Cache (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 18, 2026Updated Sep 19, 2026Source checked Sep 19, 2026First seen by HOL Sep 18, 2026Material review Sep 19, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Varnish-Software/Varnish Cache (generic), Vinyl-Cache/Vinyl Cache (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Varnish-Software/Varnish Cachegeneric	>=9.0.0 <9.0.4 \|\| >=0 <c5078ae575201b05ae8674a90ddb19ffe7f4b439 \|\| 6.3.0	9.0.4, c5078ae575201b05ae8674a90ddb19ffe7f4b439
Vinyl-Cache/Vinyl Cachegeneric	>=0 <9.0.2 \|\| >=0 <90f5bacc14b2404e6cc349ba015f0f73b8515136	9.0.2, 90f5bacc14b2404e6cc349ba015f0f73b8515136

Recommended response

Check inventory. Check lockfiles and deployed manifests for Varnish-Software/Varnish Cache, Vinyl-Cache/Vinyl Cache.
Review the reported fix. Update Varnish-Software/Varnish Cache to 9.0.4; Vinyl-Cache/Vinyl Cache to 9.0.2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 18, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 19, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 18, 2026

Sources and claim methodology

Source referencevinyl-cache.org

Upstream source description

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).

Quoted source text, attributed separately from HOL analysis.