PatchTheCVEvarnish-cache vulnerabilities
Recent CVEs affecting varnish-cache products. 4 tracked.
varnish-cache has 4 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 4. Most recent: 2021-07-14. Highest priority: CVE-2020-11653 (score 57/100).
- CVE-2021-36740 MEDIUM 6.5 UPGRADE UPGRADE Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-
- CVE-2021-28543 MEDIUM 4.0 UPGRADE UPGRADE Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in
- CVE-2020-11653 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.
- CVE-2019-20637 HIGH 7.5 UPGRADE UPGRADE An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.
FAQ
How do I fix varnish-cache vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is varnish-cache being exploited right now?
None of the tracked varnish-cache CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which varnish-cache CVE should I patch first?
CVE-2020-11653 currently ranks highest (57/100): An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3..