Gentoo alert 202608-26 (Vinyl Cache)

From:
             
 
glsamaker@gentoo.org
To:
             
 
gentoo-announce@lists.gentoo.org
Subject:
             
 
[gentoo-announce] [ GLSA 202608-26 ] Vinyl Cache: Multiple Vulnerabilities
Date:
             
 
Wed, 26 Aug 2026 12:02:13 -0000
Message-ID:
             
 
<178774573383.1.7511869529767481409@ca886869b30e>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202608-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low
    Title: Vinyl Cache: Multiple Vulnerabilities
     Date: August 26, 2026
     Bugs: #880627, #918416, #959302, #964043, #975350
       ID: 202608-26

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in Vinyl Cache, allowing
request smuggling and denial of service.

Background
==========

Vinyl Cache is a web application accelerator. Vinyl Cache was previously
named Varnish.

Affected packages
=================

Package                  Vulnerable    Unaffected
-----------------------  ------------  ------------
www-servers/vinyl-cache  < 8.0.2       >= 8.0.2

Description
===========

Multiple vulnerabilities have been discovered in Vinyl Cache. Please
review the CVE identifiers referenced below for details.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Vinyl Cache users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=www-servers/vinyl-cache-8.0.2"

References
==========

[ 1 ] CVE-2022-45059
      https://nvd.nist.gov/vuln/detail/CVE-2022-45059
[ 2 ] CVE-2022-45060
      https://nvd.nist.gov/vuln/detail/CVE-2022-45060
[ 3 ] CVE-2025-8671
      https://nvd.nist.gov/vuln/detail/CVE-2025-8671
[ 4 ] CVE-2025-30346
      https://nvd.nist.gov/vuln/detail/CVE-2025-30346
[ 5 ] CVE-2025-47905
      https://nvd.nist.gov/vuln/detail/CVE-2025-47905
[ 6 ] CVE-2026-50052
      https://nvd.nist.gov/vuln/detail/CVE-2026-50052

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202608-26

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2026 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCAA5FiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmqO1cUbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEBTEJDmlcvvZIiMP/jjaygLEWSq98mISwItb
4LFAwqHwmH6cuDafswhX3OWWC1lBZD8QF67CGwMa6qMr0WerEiNDqi/o0Seso2vF
R0SIYh42dNGRovjxGhpiddYYxbsPo1HdXE47ZNSLs3Ft9RGqgWyXDC45LecQveO9
W3K+zENORKA/1/j7F5sXApG/caG2QZQTrGbVI8uJvmbwVCuE8lbm8EbFnTzTlDpW
V0Z79xDQpmXWzLPLH/WVqGoVaYIEdIMSn4lQACUwvUETaZaOnL6VX75Ws49Hffn1
HbXkwOaIySJ7mVxUz6Lhy6l2QRJm+2O2nX8X1nIl5ENWa30/iYQNQTI+I5yCur0t
VELrlYz8jhcSb3zPxRLP5MuV9aMRUzaMkIDshq0wjH+fhUdF3VJKHKqyqRAtjEfb
QsQX1Rlm1ACvaYr0SVPHy4gvA3Q/rW+qMjwUQVEZpMTAVZZ6AiGvSYg6deHvHpfm
9NAfQ/Yl1G1Kw65OaP5TAk4sAzG2IPVqAEC94HSE4AwwKTM+yDQtpUdW2Rwhwpxi
tPpS+pJDLUCrbCy+UAFFeAuuWHZF2MtYAp2aFvP4vE0ixY4+vIibpobp8bBahBUB
+UYaW1D7YT5ynrJc19lGlV5JpqEUrYxnaf7LKjWw0AOmImoc12+NuR7pavIfSpoA
k6Nln09KYR2jmKtZPM0VDDdN
=kYbb
-----END PGP SIGNATURE-----