The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade varnish-develUpgrade varnish-docsUpgrade varnish | May 4, 2022 | Jul 14, 2021 |
| Alpine Linux | — | Upgrade varnish | Mar 26, 2024 | Jul 14, 2021 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 14, 2021 |
| Centos_linux | — | Upgrade varnish-modules-debuginfoUpgrade varnish-docsUpgrade varnishUpgrade varnish-develUpgrade varnish-modules-debugsourceUpgrade varnish-modules | Aug 3, 2021 | Jul 14, 2021 |
| Debian | — | Upgrade varnish | Mar 7, 2022 | Jul 14, 2021 |
| Oracle_linux | — | Upgrade varnish-docsUpgrade varnish-modulesUpgrade varnishUpgrade varnish-devel | Aug 4, 2021 | Jul 13, 2021 |
| Redhat_linux | — | Upgrade varnish-modules-debugsourceUpgrade varnishUpgrade varnish-develUpgrade varnish-modulesUpgrade varnish-modules-debuginfoUpgrade varnish-docs | Aug 3, 2021 | Jul 14, 2021 |
| Rocky_linux | — | Upgrade varnish-modulesUpgrade varnish-modules-debugsourceUpgrade varnish-modules-debuginfoUpgrade varnishUpgrade varnish-docsUpgrade varnish-devel | Mar 12, 2024 | Jul 14, 2021 |
| Suse | — | Upgrade libvarnishapi3Upgrade varnishUpgrade varnish-devel | Oct 26, 2022 | Jul 14, 2021 |
| Ubuntu | — | Upgrade libvarnishapi1Upgrade libvarnishapi2Upgrade varnish | Jun 9, 2022 | Jul 14, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub