PatchTheCVEvarnish cache vulnerabilities and fixes
Recent CVEs affecting varnish cache, with upgrade or downgrade steps. 5 tracked.
Also searched as: varnishcache.
varnish cache has 5 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-11-09. Highest priority: CVE-2022-23959 (score 62/100).
- CVE-2022-45060 HIGH 7.5 UPGRADE DOWNGRADE An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and
- CVE-2022-45059 HIGH 7.5 UPGRADE MITIGATE An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1
- CVE-2022-38150 HIGH 7.5 DOWNGRADE MITIGATE In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and auto
- CVE-2022-23959 CRITICAL 9.1 UPGRADE UPGRADE In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enter
- CVE-2021-36740 MEDIUM 6.5 UPGRADE UPGRADE Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-
FAQ
How do I fix varnish cache vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is varnish cache being exploited right now?
None of the tracked varnish cache CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which varnish cache CVE should I patch first?
CVE-2022-23959 currently ranks highest (62/100): In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enter.