CyberSecBulletin

Varnish Cache Project vulnerabilities

We track 2 vulnerabilities in Varnish Cache Project products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 9, 2022.

2vulnerabilities
0critical
2high
0exploited
7.5average CVSS score

Latest Varnish Cache Project vulnerabilities

  • 7.5 High severity

    Varnish Cache: Inconsistent Interpretation of HTTP Requests

    CVE-2022-45059Varnish Cache ProjectEPSS 1.77%

    An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding

  • 7.5 High severity

    Varnish Cache: Uncontrolled Resource Consumption

    CVE-2022-38150Varnish Cache ProjectEPSS 1.5%

    In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed i