Thanks to a client, I looked at CVE-2026-109618 / CVE-2026-109619 a bit longer:
The most relevant OOM vector seems to be request body processing, and, more specifically, multipart/form-data / rfc7578 processing.
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
So one option in #Vinyl_Cache is to check if you have any such requests:
vinyllog -dCq 'ReqHeader:Content-Type ~ multipart/form'
vinyllog -Cq 'ReqHeader:Content-Type ~ multipart/form'
The first command scans the in-memory log, the second runs until interrupted on live data.
If you do not see multipart/form-data requests, you can simply refuse them in VCL.
