Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-93894

Workspace Buffer Overflow in Vinyl Cache .upper() and .lower() Methods Leading to Remote Denial of Service

In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.).

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Varnish-software Vinyl-cache
Products
Varnish Cache Vinyl Cache
CVE-2026-34475

Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Varnish-software Vinyl-cache
Products
Varnish Cache Varnish Enterprise Vinyl Cache
CVE-2026-40396

varnish: Varnish Cache: Denial of Service via workspace overflow during HTTP/1 pipelining

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Varnish-software Vinyl-cache
Products
Varnish Cache Vinyl Cache
CVE-2026-40394

Varnish Cache: Varnish Enterprise: Varnish Cache and Varnish Enterprise: Denial of Service via workspace overflow

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Varnish-software Vinyl-cache
Products
Varnish Cache Varnish Enterprise Vinyl Cache
CVE-2022-45060

varnish: Request Forgery Vulnerability

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 2 more
Products
Debian Linux Fedora Enterprise Linux and 8 more
CVE-2017-12425

varnish: Missing check for integer overflow when handling chunk sizes in HTTP requests

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.

CVSS 3.0 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Varnish-cache Varnish-software Varnish Cache Project
Products
Varnish Varnish Cache Varnish Cache
CVE-2022-23959

varnish: HTTP/1 request smuggling vulnerability

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

CVSS 3.1 · 9.1 Critical EPSS 2.0% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 2 more
Products
Debian Linux Fedora Enterprise Linux and 7 more
CVE-2021-36740

varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Debian Fedoraproject Redhat and 3 more
Products
Debian Linux Fedora Enterprise Linux and 5 more
CVE-2020-11653

varnish: remote clients may cause Varnish to assert and restart which could result in DoS

An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Debian Opensuse Redhat and 2 more
Products
Debian Linux Backports Sle Leap and 3 more
CVE-2019-20637

varnish: not clearing pointer between two client requests leads to information disclosure

An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Opensuse Redhat Varnish-cache and 1 more
Products
Backports Sle Leap Enterprise Linux and 2 more
CVE-2019-15892

varnish: denial of service handling certain crafted HTTP/1 requests

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

CVSS 3.0 · 7.5 High EPSS 5.9% KEV · Not listed
Vendors
Debian Redhat Varnish-software and 1 more
Products
Debian Linux Enterprise Linux Rhel Software Collections and 2 more