Search for packages
| purl | pkg:deb/debian/varnish@6.5.1-1%2Bdeb11u3 |
| Next non-vulnerable version | 7.1.1-2+deb12u1 |
| Latest non-vulnerable version | 7.1.1-2+deb12u1 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-b85u-4g42-nyaq
Aliases: CVE-2024-30156 VSV00014 |
varnish: HTTP/2 Broken Window Attack may result in denial of service |
Affected by 0 other vulnerabilities. |
|
VCID-c4d1-jsqh-hban
Aliases: CVE-2023-44487 GHSA-qppj-fm5r-hxr3 VSV00013 |
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
Affected by 0 other vulnerabilities. |
|
VCID-c4pk-mc4n-wyh9
Aliases: CVE-2025-30346 VSV00015 |
varnish: Client-Side Desynchronization in Varnish Cache |
Affected by 2 other vulnerabilities. |
|
VCID-pb7u-beyt-fbet
Aliases: CVE-2025-47905 |
content spoofing |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-9494-9tdz-jkeb | An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. |
CVE-2022-45060
VSV00011 |
| VCID-dkhk-j3eu-53he | In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections. |
CVE-2022-23959
|
| VCID-kz93-hnzv-dyfe | url request injection |
CVE-2021-36740
|
| VCID-qswj-nhpw-3qgr | An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss. |
CVE-2020-11653
|
| VCID-xdnk-3eyc-quas | varnish: denial of service handling certain crafted HTTP/1 requests |
CVE-2019-15892
|
| VCID-zb85-shgd-9qcq | An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers. |
CVE-2019-20637
|