CVE-2022-23959
CVE-2022-23959
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
CVSS 9.1 · Critical · EPSS 2.0% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
varnish Debian:12
- Affected ranges
- ECOSYSTEM: < 7.1.0-5
Update to 7.1.0-5
varnish Debian:13
- Affected ranges
- ECOSYSTEM: < 7.1.0-5
Update to 7.1.0-5
varnish Ubuntu:14.04:LTS
- Versions
- 3.0.4-1ubuntu1
- 3.0.4-1ubuntu2
- 3.0.5-1ubuntu2
- 3.0.5-2
- 3.0.5-2ubuntu0.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
varnish Ubuntu:Pro:16.04:LTS
- Versions
- 4.0.3-1
- 4.1.0-1
- 4.1.0-2
- 4.1.1-1
- 4.1.1-1ubuntu0.2
- 4.1.1-1ubuntu0.2+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
varnish Ubuntu:18.04:LTS
- Versions
- 5.0.0-7.1
- 5.2.1-1
- Affected ranges
- ECOSYSTEM: < 5.2.1-1ubuntu0.1
Update to 5.2.1-1ubuntu0.1
varnish Ubuntu:20.04:LTS
- Versions
- 6.1.1-1
- 6.2.1-2
- Affected ranges
- ECOSYSTEM: < 6.2.1-2ubuntu0.1
Update to 6.2.1-2ubuntu0.1
varnish Ubuntu:22.04:LTS
- Versions
- 6.5.2-1
- 6.6.1-1
- Affected ranges
- ECOSYSTEM: < 6.6.1-1ubuntu0.2
Update to 6.6.1-1ubuntu0.2
varnish Ubuntu:24.04:LTS
- Versions
- 7.1.1-1.1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
varnish Ubuntu:25.10
- Versions
- 7.7.0-1
- 7.7.0-2
- 7.7.0-3
- 7.7.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
varnish Ubuntu:26.10
- Versions
- 7.7.3-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
varnish Ubuntu:26.04:LTS
- Versions
- 7.7.3-1
- 7.7.3-1build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://varnish-cache.org/security/VSV00008.html
- https://docs.varnish-software.com/security/VSV00008/
- https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/
- https://www.debian.org/security/2022/dsa-5088
- https://nvd.nist.gov/vuln/detail/CVE-2022-23959