Varnish Cache Plus vulnerabilities

2 known vulnerabilities in Varnish Cache Plus from Varnish-software. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x…

  CVE-2022-45060Nov 9, 2022Varnish-softwareEPSS 1.3%

  An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, cau

• 9.1 Critical severity

  Varnich Cache: Inconsistent Interpretation of HTTP Requests

  CVE-2022-23959Jan 26, 2022Varnish-softwareEPSS 2.01%

  In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.