Vinyl Cache versions prior to 9.0.1 contain a vulnerability in the HTTP/2 request parsing logic that allows an attacker to launch a backend request desynchronization attack, commonly known as HTTP request smuggling. This attack can be leveraged to poison the cache, bypass authentication mechanisms, or possibly disclose or manipulate information. The vulnerability only exists if the HTTP/2 feature is explicitly enabled via the feature parameter (+http2), which is disabled by default. No official remediation level or patch information is provided in the available data.

Successful exploitation can result in cache poisoning, allowing an attacker to serve malicious or stale content to users. It may also enable authentication bypass, potentially granting unauthorized access, and could lead to information disclosure or manipulation. However, the attack vector requires HTTP/2 support to be enabled, which is not the default configuration, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure HTTP/2 support is disabled (default setting) to mitigate the risk. Avoid enabling the +http2 feature parameter unless necessary and after confirming the presence of a fix.