vinyl-cache - Debian Package Tracker

general

source: vinyl-cache (main)
version: 9.0.1-4
maintainer: Vinyl Cache Package Maintainers (DMD)
uploaders: Marco d'Itri [DMD] – Stig Sandbeck Mathisen [DMD]
arch: all any
std-ver: 4.7.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

testing: 9.0.1-4
unstable: 9.0.1-4

versioned links

9.0.1-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvinylapi-dev
libvinylapi3
vinyl-cache
vinyl-cache-doc

action needed

A new upstream version is available: 9.1.0 high

A new upstream version 9.1.0 is available, you should consider packaging it.

Created: 2026-09-21 Last update: 2026-09-21 20:00

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-93894: In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).

Created: 2026-09-17 Last update: 2026-09-19 10:30

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-93894: In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).

Created: 2026-09-17 Last update: 2026-09-19 10:30

debian/patches: 1 patch with invalid metadata high

Among the 5 debian patches available in version 9.0.1-4 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.

Created: 2026-07-06 Last update: 2026-07-08 09:02

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-07-19 Last update: 2026-09-21 21:30

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit e880c2039dbb4e8729e5be13769a35f068a48d3f
Author: Marco d'Itri <md@linux.it>
Date:   Sat Jul 25 18:32:04 2026 +0200

    Use the correct directory for vinylncsa.pid

https://salsa.debian.org/api/v4/projects/varnish-team%2Fvinyl-cache API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-25 Last update: 2026-09-15 04:04

lintian reports 10 warnings normal

Lintian reports 10 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-06 Last update: 2026-07-08 06:19

news

[rss feed]

[2026-07-13] vinyl-cache 9.0.1-4 MIGRATED to testing (Debian testing watch)
[2026-07-07] Accepted vinyl-cache 9.0.1-4 (source) into unstable (Marco d'Itri)
[2026-07-05] Accepted vinyl-cache 9.0.1-3 (source) into unstable (Marco d'Itri)
[2026-07-03] Accepted vinyl-cache 9.0.1-2 (source) into experimental (Marco d'Itri)
[2026-05-25] Accepted vinyl-cache 9.0.1-1 (source amd64 all) into experimental (Marco d'Itri)
[2026-05-04] Accepted vinyl-cache 9.0.0+20260429-3 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Marco d'Itri)
[2026-05-04] Accepted vinyl-cache 9.0.0+20260429-2 (source amd64 all) into experimental (Debian FTP Masters) (signed by: Marco d'Itri)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 10)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 9.0.1-4