Varnish-software vulnerabilities
We track 8 vulnerabilities in Varnish-software products across 4 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on April 12, 2026.
Latest Varnish-software vulnerabilities
- 7.5 High severity
Varnish Cache: Always-Incorrect Control Flow Implementation
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic
- 7.5 High severity
Varnish Enterprise: Allocation of Resources Without Limits or Throttling
Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from whic
- 7.5 High severity
Varnish Cache: Always-Incorrect Control Flow Implementation
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgr
- 9.8 Critical severity
Varnish Cache: Incorrect Behavior Order: Validate Before Canonicalize
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
- 7.5 High severity
Enterprise Module for Development Tools: Improper Resource Shutdown or Release
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening strea
- 7.5 High severity
Varnish Enterprise: Out-of-bounds Read
Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects.
- 7.5 High severity
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x…
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, cau
- 9.1 Critical severity
Varnich Cache: Inconsistent Interpretation of HTTP Requests
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.