Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade varnishUpgrade varnish-modulesUpgrade varnish-docsUpgrade varnish-devel | Apr 11, 2024 | Mar 24, 2024 |
| Alpine Linux | — | Upgrade varnish | Jun 6, 2024 | Mar 24, 2024 |
| Debian | — | Upgrade varnish | May 15, 2025 | Mar 24, 2024 |
| Oracle_linux | — | Upgrade varnishUpgrade varnish-develUpgrade varnish-modulesUpgrade varnish-docs | Apr 9, 2024 | Mar 24, 2024 |
| Redhat_linux | — | Upgrade varnish-develUpgrade varnish-docsUpgrade varnish-modules-debuginfoUpgrade varnish-modules-debugsourceUpgrade varnishUpgrade varnish-modules | Apr 9, 2024 | Mar 24, 2024 |
| Rocky_linux | — | Upgrade varnishUpgrade varnish-modules-debugsourceUpgrade varnish-modules-debuginfoUpgrade varnish-modulesUpgrade varnish-docsUpgrade varnish-devel | May 8, 2024 | Mar 24, 2024 |
| Suse | — | Upgrade varnishUpgrade libvarnishapi3Upgrade varnish-devel | Dec 5, 2025 | Dec 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub