Hi

From https://vinyl-cache.org/security/VSV00020.html:

| A workspace buffer overflow vulnerability was found in the .upper()
| and .lower() string type methods of VCL.
|
|This can be used as a remote denial of service (DoS) vector to make the
| child process segfault or assert, and then restart.
|
| Effectively exploiting this vulnerability requires prior knowledge
| about the VCL in use and the ability to craft a request that contains a
| string that is long enough to fill the remaining workspace at the call
| site while staying under the different request size limits
| (http_req_size, http_req_hdr_len, ..etc).

Fixed by
https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/853d397f30753bce1587991fcf9193c63fb4d1eb
in vinyl-cache-9.0.2.

Regards,
Salvatore