openSUSE-SU-2026:22131-1
openSUSE-SU-2026:22131-1 · Security update for varnish
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for varnish fixes the following issues: Changes in varnish: - update to 7.7.3 (bsc#1280114, CVE-2025-8671): * https://vinyl-cache.org/docs/7.7/whats-new/changes-7.7.html * https://vinyl-cache.org/security/VSV00017.html#vsv00017 - Update to release 7.7.1 * VSV-16: Resolve request smuggling attack - Update to release 7.7.0 * The `linux` jail gained control of transparent huge pages settings. * An issue has been fixed which could cause a crash when varnishd receives an invalid Content-Range header from a backend. * Timestamping for HTTP/2 requests (when idle period begins) has been switched to be more in line with HTTP/1. * VSV-15: The client connection is now always closed when a malformed request is received. [CVE-2025-30346, boo#1239892]
Fix available
- Published
- Updated
Stack: system
Affected products and versions
varnish openSUSE:Leap 16.0
- Affected ranges
- ECOSYSTEM: < 7.7.3-bp160.1.1
Update to 7.7.3-bp160.1.1