Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/942031?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "type": "deb", "namespace": "debian", "name": "varnish", "version": "0", "qualifiers": { "distro": "trixie" }, "subpath": "", "is_vulnerable": false, "next_non_vulnerable_version": "2.1.0-2", "latest_non_vulnerable_version": "7.7.3-2", "affected_by_vulnerabilities": [], "fixing_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/79153?format=api", "vulnerability_id": "VCID-15q9-f712-bfgs", "summary": "varnish: denial of service via colon-starting reason phrase", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38150.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-38150.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-38150", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71614", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71848", "published_at": "2026-05-15T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71729", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71735", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.7172", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71754", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71787", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71753", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71781", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71839", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71632", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71604", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71644", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71655", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71679", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71662", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71688", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71694", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71675", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00684", "scoring_system": "epss", "scoring_elements": "0.71724", "published_at": "2026-04-24T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-38150" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117692", "reference_id": "2117692", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117692" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/", "reference_id": "M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-20T18:02:09Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3X4PEKC5C736SCKE2UG3Y7JWKMD2K6/", "reference_id": "TW3X4PEKC5C736SCKE2UG3Y7JWKMD2K6", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-20T18:02:09Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TW3X4PEKC5C736SCKE2UG3Y7JWKMD2K6/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2BUKFICLZBXESLQ3MXMIG3G52RZURFK/", "reference_id": "V2BUKFICLZBXESLQ3MXMIG3G52RZURFK", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-20T18:02:09Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2BUKFICLZBXESLQ3MXMIG3G52RZURFK/" }, { "reference_url": "https://varnish-cache.org/security/VSV00009.html", "reference_id": "VSV00009.html", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-10-20T18:02:09Z/" } ], "url": "https://varnish-cache.org/security/VSV00009.html" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942028?format=api", "purl": "pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@6.5.1-1%252Bdeb11u3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942042?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942026?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-2%2Bdeb12u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-2%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942030?format=api", "purl": "pkg:deb/debian/varnish@7.7.0-3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cmeu-b3fh-hkaf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942029?format=api", "purl": "pkg:deb/debian/varnish@7.7.3-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.3-2%3Fdistro=trixie" } ], "aliases": [ "CVE-2022-38150" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-15q9-f712-bfgs" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/351754?format=api", "vulnerability_id": "VCID-1hgg-j6bp-4qcz", "summary": "Varnish: Varnish Enterprise: Denial of Service via workspace overflow", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40395.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40395.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40395", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00039", "scoring_system": "epss", "scoring_elements": "0.11515", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00039", "scoring_system": "epss", "scoring_elements": "0.11658", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17184", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17081", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17175", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17145", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17183", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17267", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.173", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17206", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17125", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.16989", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.18759", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.1876", "published_at": "2026-05-15T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40395" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457698", "reference_id": "2457698", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457698" }, { "reference_url": "https://docs.varnish-software.com/security/VEV00003/", "reference_id": "VEV00003", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-13T15:45:24Z/" } ], "url": "https://docs.varnish-software.com/security/VEV00003/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942028?format=api", "purl": "pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@6.5.1-1%252Bdeb11u3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942026?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-2%2Bdeb12u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-2%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942030?format=api", "purl": "pkg:deb/debian/varnish@7.7.0-3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cmeu-b3fh-hkaf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942029?format=api", "purl": "pkg:deb/debian/varnish@7.7.3-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.3-2%3Fdistro=trixie" } ], "aliases": [ "CVE-2026-40395" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1hgg-j6bp-4qcz" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/78883?format=api", "vulnerability_id": "VCID-1wyt-mkrq-q3ek", "summary": "varnish: Request Smuggling Vulnerability", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45059.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-45059.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2022-45059", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81217", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.8146", "published_at": "2026-05-15T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81339", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81344", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81361", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81381", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81403", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81399", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81418", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81457", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81241", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81239", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81267", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81272", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81293", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81279", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81271", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81308", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.8131", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.01524", "scoring_system": "epss", "scoring_elements": "0.81332", "published_at": "2026-04-24T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-45059" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023750", "reference_id": "1023750", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023750" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141839", "reference_id": "2141839", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141839" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/", "reference_id": "G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-01T14:30:02Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/", "reference_id": "M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-01T14:30:02Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/" }, { "reference_url": "https://varnish-cache.org/security/VSV00010.html", "reference_id": "VSV00010.html", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-01T14:30:02Z/" } ], "url": "https://varnish-cache.org/security/VSV00010.html" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/", "reference_id": "XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-01T14:30:02Z/" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942028?format=api", "purl": "pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@6.5.1-1%252Bdeb11u3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942043?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-1.1?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-1.1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942026?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-2%2Bdeb12u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-2%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942030?format=api", "purl": "pkg:deb/debian/varnish@7.7.0-3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cmeu-b3fh-hkaf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942029?format=api", "purl": "pkg:deb/debian/varnish@7.7.3-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.3-2%3Fdistro=trixie" } ], "aliases": [ "CVE-2022-45059", "VSV00010" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1wyt-mkrq-q3ek" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/351731?format=api", "vulnerability_id": "VCID-59du-vsr4-hubc", "summary": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40394.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40394.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40394", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00039", "scoring_system": "epss", "scoring_elements": "0.11515", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00039", "scoring_system": "epss", "scoring_elements": "0.11658", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17184", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17081", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17175", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17145", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17183", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17267", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.173", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17206", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.17125", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00055", "scoring_system": "epss", "scoring_elements": "0.16989", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.18759", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.0006", "scoring_system": "epss", "scoring_elements": "0.1876", "published_at": "2026-05-15T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40394" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40394", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40394" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457695", "reference_id": "2457695", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457695" }, { "reference_url": "https://docs.varnish-software.com/security/VEV00002/", "reference_id": "VEV00002", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-13T15:45:49Z/" } ], "url": "https://docs.varnish-software.com/security/VEV00002/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942028?format=api", "purl": "pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@6.5.1-1%252Bdeb11u3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942026?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-2%2Bdeb12u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-2%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942030?format=api", "purl": "pkg:deb/debian/varnish@7.7.0-3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cmeu-b3fh-hkaf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942029?format=api", "purl": "pkg:deb/debian/varnish@7.7.3-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.3-2%3Fdistro=trixie" } ], "aliases": [ "CVE-2026-40394" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-59du-vsr4-hubc" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/351753?format=api", "vulnerability_id": "VCID-gt8m-rdmz-zkbd", "summary": "varnish: Varnish Cache: Denial of Service via workspace overflow during HTTP/1 pipelining", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40396.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-40396.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40396", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00012", "scoring_system": "epss", "scoring_elements": "0.01635", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00012", "scoring_system": "epss", "scoring_elements": "0.01647", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03484", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03537", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03502", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03521", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03555", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03559", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03565", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03382", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03497", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00016", "scoring_system": "epss", "scoring_elements": "0.03489", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04368", "published_at": "2026-05-15T12:55:00Z" }, { "value": "0.00017", "scoring_system": "epss", "scoring_elements": "0.04356", "published_at": "2026-05-14T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-40396" }, { "reference_url": "https://github.com/varnish/varnish/issues/15", "reference_id": "15", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-13T15:35:30Z/" } ], "url": "https://github.com/varnish/varnish/issues/15" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457697", "reference_id": "2457697", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457697" }, { "reference_url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1", "reference_id": "varnish-9.0.1", "reference_type": "", "scores": [ { "value": "4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-13T15:35:30Z/" } ], "url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942028?format=api", "purl": "pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@6.5.1-1%252Bdeb11u3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942026?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-2%2Bdeb12u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-2%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942030?format=api", "purl": "pkg:deb/debian/varnish@7.7.0-3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cmeu-b3fh-hkaf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942029?format=api", "purl": "pkg:deb/debian/varnish@7.7.3-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.3-2%3Fdistro=trixie" } ], "aliases": [ "CVE-2026-40396" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gt8m-rdmz-zkbd" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/34475?format=api", "vulnerability_id": "VCID-tn51-4but-w3dk", "summary": "Multiple vulnerabilities have been found in Varnish, the worst of\n which could allow a remote attacker to create a Denial of Service\n condition.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2013-0345", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.1457", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.1462", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.1469", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14501", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.1459", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14648", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14607", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14568", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14508", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14399", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14401", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14473", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14506", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14504", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14447", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14326", "published_at": "2026-05-05T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14461", "published_at": "2026-05-07T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14554", "published_at": "2026-05-09T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14553", "published_at": "2026-05-11T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14596", "published_at": "2026-05-12T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14676", "published_at": "2026-05-14T12:55:00Z" }, { "value": "0.00047", "scoring_system": "epss", "scoring_elements": "0.14683", "published_at": "2026-05-15T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2013-0345" }, { "reference_url": "https://security.gentoo.org/glsa/201412-30", "reference_id": "GLSA-201412-30", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/201412-30" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/942031?format=api", "purl": "pkg:deb/debian/varnish@0?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942028?format=api", "purl": "pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@6.5.1-1%252Bdeb11u3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942026?format=api", "purl": "pkg:deb/debian/varnish@7.1.1-2%2Bdeb12u1?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-5781-s1ny-q7ey" }, { "vulnerability": "VCID-cmeu-b3fh-hkaf" }, { "vulnerability": "VCID-djsh-vmzh-sbe7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.1.1-2%252Bdeb12u1%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942030?format=api", "purl": "pkg:deb/debian/varnish@7.7.0-3?distro=trixie", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-cmeu-b3fh-hkaf" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.0-3%3Fdistro=trixie" }, { "url": "http://public2.vulnerablecode.io/api/packages/942029?format=api", "purl": "pkg:deb/debian/varnish@7.7.3-2?distro=trixie", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@7.7.3-2%3Fdistro=trixie" } ], "aliases": [ "CVE-2013-0345" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-tn51-4but-w3dk" } ], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/varnish@0%3Fdistro=trixie" }