CVE-2022-45059
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request...
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
CVE-2022-45059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
CVE List
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
CVE-2022-45059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2022-47981
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
EUVD-2022-47981- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-p22x-6r5h-g873
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request...
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
GHSA-p22x-6r5h-g873- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-45059
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
ALPINE-CVE-2022-45059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSV
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
CVE-2022-45059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2022-45059
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
DEBIAN-CVE-2022-45059- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVOESA-2023-1915
varnish security update
This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.
Security Fix(es):
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.(CVE-2022-45059)
- Record
OESA-2023-1915- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2023-1916
varnish security update
This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.
Security Fix(es):
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.(CVE-2022-45059)
- Record
OESA-2023-1916- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2023-1917
varnish security update
This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.
Security Fix(es):
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.(CVE-2022-45059)
- Record
OESA-2023-1917- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVBIT-varnish-2022-45059 No score
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
- Record
BIT-varnish-2022-45059- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10198-1 No score
Security update for varnish
This update for varnish fixes the following issues:
Update to 7.2.1:
- CVE-2022-45059: Fixed a HTTP request smuggling via hop-by-hop headers (boo#1205243).
- CVE-2022-45060: Fixed a HTTP request forgery via character injection through HTTP/2 pseudo-headers (boo#1205242).
- Record
openSUSE-SU-2022:10198-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12496-1 No score
libvarnishapi3-7.2.1-1.1 on GA media
These are all security issues fixed in the libvarnishapi3-7.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12496-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10751-1 No score
libvinylapi3-9.0.0-1.1 on GA media
These are all security issues fixed in the libvinylapi3-9.0.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10751-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
varnishAlpine:v3.17 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.18 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.19 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.20 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.21 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.22 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.23 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishAlpine:v3.24 |
before 7.2.1-r0 | 7.2.1-r0 |
varnishBitnami |
7.0.0 up to 7.1.2, 7.2.0 up to 7.2.1 | 7.1.27.2.1 |
varnishDebian:12 |
before 7.1.1-1.1 | 7.1.1-1.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
varnishDebian:13 |
before 7.1.1-1.1 | 7.1.1-1.1 |
varnishopenEuler:22.03-LTS-SP1 |
before 7.0.1-9.oe2203sp1 | 7.0.1-9.oe2203sp1 |
varnishopenEuler:22.03-LTS-SP2 |
before 7.0.1-9.oe2203sp2 | 7.0.1-9.oe2203sp2 |
varnishopenEuler:22.03-LTS |
before 7.0.1-8.oe2203 | 7.0.1-8.oe2203 |
varnishSUSE:Package Hub 15 SP4 From an advisory covering 2 CVEs |
before 7.2.1-bp154.2.9.1 | 7.2.1-bp154.2.9.1 |
varnishopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 7.2.1-bp154.2.9.1 | 7.2.1-bp154.2.9.1 |
varnishopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 7.2.1-1.1 | 7.2.1-1.1 |
vinyl-cacheopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 9.0.0-1.1 | 9.0.0-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | martinvks/CVE-2022-45059-demo | 2023-11-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-45059 is a high vulnerability (CVSS 7.5) in Varnish Cache Project Cache, published November 9, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.82%, the 78th percentile. Fixed in varnish 7.2.1-r0.
References
varnish-cache.org/security/VSV00010.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5
nvd.nist.gov/vuln/detail/CVE-2022-45059
Show 20 moreShow less
github.com/advisories/GHSA-p22x-6r5h-g873
security.alpinelinux.org/vuln/CVE-2022-45059
security-tracker.debian.org/tracker/CVE-2022-45059
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1915
lists.opensuse.org/archives/list/[email protected]/thread/FJFEBVAZE52U2TMYLTOEW3F7YGVD7XQL
bugzilla.suse.com/1205242
suse.com/security/cve/CVE-2022-45059