Oct 21, 2026, 1:11 PMDisabling any request body processing with #Vinyl_Cache to avoid the #php RCE is simple:
sub vcl_recv {
if (req.http.Content-Length || req.http.Transfer-Encoding) {
return (synth(403, "No req body"));
}
}
- Oct 21, 2026, 1:11 PM
Replies
- Oct 21, 2026, 1:18 PM
With vmod_re, you acn also specifically match contents: https://vinyl-cache.org/tutorials/body_regex.html#search-client-request-bodies-in-vcl-recv
This might become useful once specific patterns indicating attack vectors become known.
- Oct 21, 2026, 8:29 PM
Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:
The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp - Oct 21, 2026, 8:36 PM
So one option in #Vinyl_Cache is to check if you have any such requests:
vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form'
vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form'The first command scans the in-memory log, the second runs until interrupted on live data.
If you do not see multipart/form-data requests, you can simply refuse them in VCL.
- Oct 21, 2026, 8:54 PM
Another very simple option in #Vinyl_Cache is to limit the size of request bodies using std.cache_req_body(). This also has the added benefit that chunked transfer encoding is tuned into a request with a content-length, such that php can check it upfront against the maximum body size.
In the example, the maximum size should be adjusted accordingly.
https://vinyl-cache.org/docs/trunk/reference/vmod_std.html#std-cache-req-body
- Oct 21, 2026, 10:44 PM
Turned this into a short article. https://fosstodon.org/@vinyl_cache/117481311068491278
Good night
