Every CVE Search/ Get API key

CVE-2025-47905

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow...

5.4 MediumFix available

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.37%Up 0.3 points since May 14, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
CVE-2025-47905
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2025-14634 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
EUVD-2025-14634
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-cvpp-rmjx-5x2m 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow...

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
GHSA-cvpp-rmjx-5x2m
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
NVD 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
CVE-2025-47905
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2025-47905 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
ALPINE-CVE-2025-47905
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2025-47905 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
DEBIAN-CVE-2025-47905
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 21 moreShow less
OSVOESA-2025-1556 5.4

varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.

Security Fix(es):

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.(CVE-2025-47905)

Record
OESA-2025-1556
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2025:8294 8.1

Red Hat Security Advisory: varnish:6 security update

Record
RHSA-2025:8294
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8310 8.1

Red Hat Security Advisory: varnish:6 security update

Record
RHSA-2025:8310
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8336 8.1

Red Hat Security Advisory: varnish:6 security update

Record
RHSA-2025:8336
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8337 8.1

Red Hat Security Advisory: varnish security update

Record
RHSA-2025:8337
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8339 8.1

Red Hat Security Advisory: varnish:6 security update

Record
RHSA-2025:8339
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8340 8.1

Red Hat Security Advisory: varnish:6 security update

Record
RHSA-2025:8340
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8349 8.1

Red Hat Security Advisory: varnish security update

Record
RHSA-2025:8349
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8350 8.1

Red Hat Security Advisory: varnish security update

Record
RHSA-2025:8350
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8351 8.1

Red Hat Security Advisory: varnish security update

Record
RHSA-2025:8351
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2025:8550 8.1

Red Hat Security Advisory: varnish security update

Record
RHSA-2025:8550
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2025:8336 8.1

Important: varnish:6 security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

  • varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:8336
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2025:8337 8.1

Important: varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

  • varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:8337
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRLSA-2025:8550 8.1

Important: varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

  • varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2025:8550
CVSS 3.1
8.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-47905 5.4

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
UBUNTU-CVE-2025-47905
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2025:8336 No score

Important: varnish:6 security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

  • varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:8336
Updated
2026-11-02
OSVALSA-2025:8337 No score

Important: varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

  • varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:8337
Updated
2026-11-02
OSVALSA-2025:8550 No score

Important: varnish security update

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

  • varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2025:8550
Updated
2026-11-02
OSVBIT-varnish-2025-47905 No score

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
BIT-varnish-2025-47905
Updated
2026-11-02
OSVCLSA-2025-1763374645 No score

varnish: Fix of 2 CVEs

  • CVE-2024-30156: fix HTTP/2 flow control vulnerability allowing window credit exhaustion (Broke Window Attack) causing potential denial of service
  • CVE-2025-47905: fix client-side request smuggling via malformed HTTP/1 chunked requests
Record
CLSA-2025-1763374645
Updated
2026-11-02
OSV No score

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Record
CVE-2025-47905
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
varnish
Alpine:v3.21
 before 7.6.3-r0
7.6.3-r0
varnish
Alpine:v3.22
 before 7.7.1-r0
7.7.1-r0
varnish
Alpine:v3.23
 before 7.7.1-r0
7.7.1-r0
varnish
Alpine:v3.24
 before 7.7.1-r0
7.7.1-r0
varnish
AlmaLinux:8
 before 6.0.13-1.module_el8.10.0+4003+9759c3c1.1
6.0.13-1.module_el8.10.0+4003+9759c3c1.1
varnish-devel
AlmaLinux:8
 before 6.0.13-1.module_el8.10.0+4003+9759c3c1.1
6.0.13-1.module_el8.10.0+4003+9759c3c1.1
varnish-docs
AlmaLinux:8
 before 6.0.13-1.module_el8.10.0+4003+9759c3c1.1
6.0.13-1.module_el8.10.0+4003+9759c3c1.1
varnish-modules
AlmaLinux:8
 before 0.15.0-6.module_el8.9.0+3826+307eaba4
0.15.0-6.module_el8.9.0+3826+307eaba4
varnish
AlmaLinux:9
 before 6.6.2-6.el9_6.1
6.6.2-6.el9_6.1
varnish-devel
AlmaLinux:9
 before 6.6.2-6.el9_6.1
6.6.2-6.el9_6.1
Show 96 moreShow less
Affected packages
PackageAffectedFixed
varnish-docs
AlmaLinux:9
 before 6.6.2-6.el9_6.1
6.6.2-6.el9_6.1
varnish
AlmaLinux:10
 before 7.6.1-2.el10_0.1
7.6.1-2.el10_0.1
varnish-devel
AlmaLinux:10
 before 7.6.1-2.el10_0.1
7.6.1-2.el10_0.1
varnish-docs
AlmaLinux:10
 before 7.6.1-2.el10_0.1
7.6.1-2.el10_0.1
varnish
Bitnami
 before 6.6.2, 7.0.0 and later
6.6.2
varnish
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 6.6.2-3.el9_2.1.tuxcare.els1
6.6.2-3.el9_2.1.tuxcare.els1
varnish-devel
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 6.6.2-3.el9_2.1.tuxcare.els1
6.6.2-3.el9_2.1.tuxcare.els1
varnish-docs
TuxCare:AlmaLinux:9.2
From an advisory covering 2 CVEs
 before 6.6.2-3.el9_2.1.tuxcare.els1
6.6.2-3.el9_2.1.tuxcare.els1
varnish
Debian:12
 before 7.1.1-2+deb12u1, plus listed versions
7.1.1-1.17.1.1-1.1+deb12u17.1.1-1.2
7.1.1-2+deb12u1
varnish
Debian:13
 before 7.7.0-2
7.7.0-2
varnish
Debian:11
 before 6.5.1-1+deb11u5, plus listed versions
6.5.1-16.5.1-1+deb11u16.5.1-1+deb11u26.5.1-1+deb11u36.5.1-1+deb11u4
6.5.1-1+deb11u5
varnish
Debian:12
From an advisory covering 2 CVEs
 before 7.1.1-2+deb12u1, plus listed versions
7.1.1-1.17.1.1-1.1+deb12u17.1.1-1.2
7.1.1-2+deb12u1
varnish
openEuler:22.03-LTS-SP4
 before 7.4.3-3.oe2203sp4
7.4.3-3.oe2203sp4
varnish
openEuler:24.03-LTS
 before 7.4.3-3.oe2403sp1
7.4.3-3.oe2403sp1
varnish
openEuler:24.03-LTS-SP1
 before 7.4.3-3.oe2403sp1
7.4.3-3.oe2403sp1
varnish
openEuler:20.03-LTS-SP4
 before 7.4.3-3.oe2003sp4
7.4.3-3.oe2003sp4
varnish
openEuler:22.03-LTS-SP3
 before 7.4.3-3.oe2203sp3
7.4.3-3.oe2203sp3
varnish
Red Hat:rhel_eus:8.8::appstream
 before 0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3
0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3
varnish-devel
Red Hat:rhel_eus:8.8::appstream
 before 0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3
0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3
varnish-docs
Red Hat:rhel_eus:8.8::appstream
 before 0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3
0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3
varnish-modules
Red Hat:rhel_eus:8.8::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debuginfo
Red Hat:rhel_eus:8.8::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debugsource
Red Hat:rhel_eus:8.8::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish
Red Hat:rhel_aus:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-devel
Red Hat:rhel_aus:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-docs
Red Hat:rhel_aus:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-modules
Red Hat:rhel_aus:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish
Red Hat:rhel_e4s:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-devel
Red Hat:rhel_e4s:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-docs
Red Hat:rhel_e4s:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-modules
Red Hat:rhel_e4s:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debuginfo
Red Hat:rhel_e4s:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debugsource
Red Hat:rhel_e4s:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish
Red Hat:rhel_tus:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-devel
Red Hat:rhel_tus:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-docs
Red Hat:rhel_tus:8.6::appstream
 before 0:6.0.8-2.module+el8.6.0+23122+0639db89.4
0:6.0.8-2.module+el8.6.0+23122+0639db89.4
varnish-modules
Red Hat:rhel_tus:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debuginfo
Red Hat:rhel_tus:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish-modules-debugsource
Red Hat:rhel_tus:8.6::appstream
 before 0:0.15.0-6.module+el8.5.0+11976+0b4af72d
0:0.15.0-6.module+el8.5.0+11976+0b4af72d
varnish
Red Hat:enterprise_linux:8::appstream
 before 0:6.0.13-1.module+el8.10.0+23111+831cc069.1
0:6.0.13-1.module+el8.10.0+23111+831cc069.1
varnish-devel
Red Hat:enterprise_linux:8::appstream
 before 0:6.0.13-1.module+el8.10.0+23111+831cc069.1
0:6.0.13-1.module+el8.10.0+23111+831cc069.1
varnish-docs
Red Hat:enterprise_linux:8::appstream
 before 0:6.0.13-1.module+el8.10.0+23111+831cc069.1
0:6.0.13-1.module+el8.10.0+23111+831cc069.1
varnish-modules
Red Hat:enterprise_linux:8::appstream
 before 0:0.15.0-6.module+el8.10.0+21682+bcdd3a30
0:0.15.0-6.module+el8.10.0+21682+bcdd3a30
varnish-modules-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:0.15.0-6.module+el8.10.0+21682+bcdd3a30
0:0.15.0-6.module+el8.10.0+21682+bcdd3a30
varnish-modules-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:0.15.0-6.module+el8.10.0+21682+bcdd3a30
0:0.15.0-6.module+el8.10.0+21682+bcdd3a30
varnish
Red Hat:enterprise_linux:9::appstream
 before 0:6.6.2-6.el9_6.1
0:6.6.2-6.el9_6.1
varnish-docs
Red Hat:enterprise_linux:9::appstream
 before 0:6.6.2-6.el9_6.1
0:6.6.2-6.el9_6.1
varnish-devel
Red Hat:enterprise_linux:9::crb
 before 0:6.6.2-6.el9_6.1
0:6.6.2-6.el9_6.1
varnish
Red Hat:rhel_aus:8.2::appstream
 before 0:6.0.6-1.module+el8.2.0+23124+897a7786.1
0:6.0.6-1.module+el8.2.0+23124+897a7786.1
varnish-devel
Red Hat:rhel_aus:8.2::appstream
 before 0:6.0.6-1.module+el8.2.0+23124+897a7786.1
0:6.0.6-1.module+el8.2.0+23124+897a7786.1
varnish-docs
Red Hat:rhel_aus:8.2::appstream
 before 0:6.0.6-1.module+el8.2.0+23124+897a7786.1
0:6.0.6-1.module+el8.2.0+23124+897a7786.1
varnish-modules
Red Hat:rhel_aus:8.2::appstream
 before 0:0.15.0-4.module+el8+2481+4078e9d2
0:0.15.0-4.module+el8+2481+4078e9d2
varnish-modules-debuginfo
Red Hat:rhel_aus:8.2::appstream
 before 0:0.15.0-4.module+el8+2481+4078e9d2
0:0.15.0-4.module+el8+2481+4078e9d2
varnish-modules-debugsource
Red Hat:rhel_aus:8.2::appstream
 before 0:0.15.0-4.module+el8+2481+4078e9d2
0:0.15.0-4.module+el8+2481+4078e9d2
varnish
Red Hat:rhel_aus:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-devel
Red Hat:rhel_aus:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-docs
Red Hat:rhel_aus:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-modules
Red Hat:rhel_aus:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish-modules-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish-modules-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish
Red Hat:rhel_e4s:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-devel
Red Hat:rhel_e4s:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-docs
Red Hat:rhel_e4s:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-modules
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish-modules-debuginfo
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish-modules-debugsource
Red Hat:rhel_e4s:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish
Red Hat:rhel_tus:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-devel
Red Hat:rhel_tus:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-docs
Red Hat:rhel_tus:8.4::appstream
 before 0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6
varnish-modules
Red Hat:rhel_tus:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish-modules-debuginfo
Red Hat:rhel_tus:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish-modules-debugsource
Red Hat:rhel_tus:8.4::appstream
 before 0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
0:0.15.0-5.module+el8.3.0+6843+b3b42fcc
varnish
Red Hat:rhel_eus:9.4::appstream
 before 0:6.6.2-5.el9_4.1
0:6.6.2-5.el9_4.1
varnish-docs
Red Hat:rhel_eus:9.4::appstream
 before 0:6.6.2-5.el9_4.1
0:6.6.2-5.el9_4.1
varnish-devel
Red Hat:rhel_eus:9.4::crb
 before 0:6.6.2-5.el9_4.1
0:6.6.2-5.el9_4.1
varnish
Red Hat:rhel_e4s:9.0::appstream
 before 0:6.6.2-2.el9_0.4
0:6.6.2-2.el9_0.4
varnish-docs
Red Hat:rhel_e4s:9.0::appstream
 before 0:6.6.2-2.el9_0.4
0:6.6.2-2.el9_0.4
varnish
Red Hat:rhel_eus:9.2::appstream
 before 0:6.6.2-3.el9_2.3
0:6.6.2-3.el9_2.3
varnish-docs
Red Hat:rhel_eus:9.2::appstream
 before 0:6.6.2-3.el9_2.3
0:6.6.2-3.el9_2.3
varnish-devel
Red Hat:rhel_eus:9.2::crb
 before 0:6.6.2-3.el9_2.3
0:6.6.2-3.el9_2.3
varnish
Red Hat:enterprise_linux:10.0
 before 0:7.6.1-2.el10_0.1
0:7.6.1-2.el10_0.1
varnish-docs
Red Hat:enterprise_linux:10.0
 before 0:7.6.1-2.el10_0.1
0:7.6.1-2.el10_0.1
varnish-devel
Red Hat:enterprise_linux:10.0
 before 0:7.6.1-2.el10_0.1
0:7.6.1-2.el10_0.1
varnish
Rocky Linux:8
 before 0:6.0.13-1.module+el8.10.0+1982+334a201b.1
0:6.0.13-1.module+el8.10.0+1982+334a201b.1
varnish
Rocky Linux:8
 before 0:6.0.13-1.module+el8.9.0+1777+0acf9965
0:6.0.13-1.module+el8.9.0+1777+0acf9965
varnish-modules
Rocky Linux:8
 before 0:0.15.0-6.module+el8.5.0+677+2a78a869
0:0.15.0-6.module+el8.5.0+677+2a78a869
varnish
Rocky Linux:9
 before 0:6.6.2-6.el9_6.1
0:6.6.2-6.el9_6.1
varnish
Rocky Linux:10
 before 0:7.6.1-2.el10_0.1
0:7.6.1-2.el10_0.1
varnish
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.0.4-1ubuntu13.0.4-1ubuntu23.0.5-1ubuntu23.0.5-23.0.5-2ubuntu0.1
 None known
varnish
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.0.3-14.1.0-14.1.0-24.1.1-14.1.1-1ubuntu0.24.1.1-1ubuntu0.2+esm1
 None known
varnish
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.0.0-7.15.2.1-15.2.1-1ubuntu0.15.2.1-1ubuntu0.1+esm1
 None known
varnish
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
6.1.1-16.2.1-26.2.1-2ubuntu0.1~esm16.2.1-2ubuntu0.1~esm26.2.1-2ubuntu0.16.2.1-2ubuntu0.26.2.1-2ubuntu0.2+esm1
 None known
varnish
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
6.5.2-16.6.1-16.6.1-1ubuntu0.26.6.1-1ubuntu0.2+esm1
 None known
varnish
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.1.1-1.1ubuntu1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-47905 is a medium vulnerability (CVSS 5.4) in Varnish-software Varnish Cache, published May 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 30th percentile. Fixed in varnish 7.6.3-r0.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open