https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-36740.htmlhttps://patchthecve.com/cve/CVE-2021-36740.htmlWed, 17 Jun 2026 03:59:05 +0000MEDIUM 6.5: Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.https://patchthecve.com/cve/CVE-2021-28543.htmlhttps://patchthecve.com/cve/CVE-2021-28543.htmlWed, 17 Jun 2026 03:46:30 +0000MEDIUM 4.0: Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some configurations. This does not affect organizations that only install the Varnish Cache product; however, it is common to install both Varnish Cache and varnish-modules. Specifically, ahttps://patchthecve.com/cve/CVE-2020-11653.htmlhttps://patchthecve.com/cve/CVE-2020-11653.htmlWed, 17 Jun 2026 02:50:33 +0000HIGH 7.5: An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.https://patchthecve.com/cve/CVE-2019-20637.htmlhttps://patchthecve.com/cve/CVE-2019-20637.htmlWed, 17 Jun 2026 02:30:51 +0000HIGH 7.5: An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connecti