Varnish Enterprise vulnerabilities
5 known vulnerabilities in Varnish Enterprise from Varnish-software. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Varnish Enterprise: Allocation of Resources Without Limits or Throttling
Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from whic
- 7.5 High severity
Varnish Cache: Always-Incorrect Control Flow Implementation
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgr
- 9.8 Critical severity
Varnish Cache: Incorrect Behavior Order: Validate Before Canonicalize
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
- 7.5 High severity
Enterprise Module for Development Tools: Improper Resource Shutdown or Release
A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening strea
- 7.5 High severity
Varnish Enterprise: Out-of-bounds Read
Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects.