CVE-2022-23959

Description

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

References

https://www.debian.org/security/2022/dsa-5088

https://varnish-cache.org/security/VSV00008.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/

https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html

https://docs.varnish-software.com/security/VSV00008/

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3