{"id":"CVE-2019-15892","aliases":["ALPINE-CVE-2019-15892","DEBIAN-CVE-2019-15892","DSA-4514-1","EUVD-2019-6803","GHSA-3775-frgh-j3vc","OESA-2021-1032","RHEA-2020:2262","RHSA-2020:4756","RLSA-2020:4756","UBUNTU-CVE-2019-15892","openSUSE-SU-2019:2184-1","openSUSE-SU-2019:2221-1","openSUSE-SU-2024:11493-1","openSUSE-SU-2026:10751-1"],"status":"published","title":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An...","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.059,"percentile":0.93289,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-617"],"published":"2019-09-03T20:56:18Z","modified":"2026-10-24T10:30:47Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"varnish","fixed_in":["6.0.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"varnish","fixed_in":["6.2.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"varnish","fixed_in":["6.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["6.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"varnish","fixed_in":["6.1.1-1+deb10u1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS","package":"varnish","fixed_in":["6.0.0-7.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"varnish","fixed_in":["6.0.0-7.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6","fixed_in":["0:4.1-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-runtime","fixed_in":["0:4.1-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-scldevel","fixed_in":["0:4.1-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish","fixed_in":["0:6.0.6-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-devel","fixed_in":["0:6.0.6-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-docs","fixed_in":["0:6.0.6-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-libs","fixed_in":["0:6.0.6-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules","fixed_in":["0:0.15.0-6.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.el7"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"varnish","fixed_in":["6.2.1-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"varnish","fixed_in":["6.2.1-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"varnish","fixed_in":["6.2.1-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"varnish","fixed_in":["6.2.1-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"varnish","fixed_in":["6.6.1-1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-1+deb10u1"}]}],"versions":["6.1.1-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-7.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-7.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+179+20b582cc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+179+20b582cc"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-1.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vinyl-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1.1"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"varnish-software","product":"varnish_cache"},{"vendor":"varnish_cache_project","product":"varnish_cache"}],"references":[{"url":"https://varnish-cache.org/security/VSV00003.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://seclists.org/bugtraq/2019/Sep/5","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"https://www.debian.org/security/2019/dsa-4514","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00069.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLSF54TDJWJLINIFEW5V5BKDNY5EQRR3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15892","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3OEOCYRU43TWEU2C65F3D6GK64MSWNNK/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DBAQF6UDRSTURGINIMSMLJR4PTDYWA7C/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KLSF54TDJWJLINIFEW5V5BKDNY5EQRR3/"},{"url":"https://github.com/advisories/GHSA-3775-frgh-j3vc"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-15892","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-15892","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1032","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHEA-2020:2262","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_software_collections/3/html/3.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1707831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1798849","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_2262.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1756079","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15892","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4756","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813867","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4756.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20637","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11653","tags":["advisory"]},{"url":"https://varnish-cache.org/security/VSV00005.html#vsv00005","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4756","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-15892","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/1cb778f6f69737109e8c070a74b8e95b78f46d13","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/0f0e51e9871ed1bd1236378f8b0dea0d33df4e9e","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/72df38fa8bfc0f5ca4a75d3e32657e8e590d85ab","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/dd47e658a0de9d12c433a4a01fb43ea4fe4d3a41","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/34717183beda3803e3d54c9826a1a9f026ca2505","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/ec3997a59a93cbc13a3cba22dfe0b4c4710a8f65","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/af13de03eaa3d04f60ada52ed3235d545b8d3973","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/6da64a47beff44ecdb45c82b033811f2d19819af","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/AWPBCC3MHKJATBZQOOYCIA3GVIFCGWDK/#AWPBCC3MHKJATBZQOOYCIA3GVIFCGWDK","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149382","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15892","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EUILTBTXVXCNRCSBNVQOFYGAQZGHOI3D/#EUILTBTXVXCNRCSBNVQOFYGAQZGHOI3D","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30346","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-15892","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2019-09-03T20:56:18Z","modified":"2024-08-05T01:03:32.487Z","updated_at":"2026-11-02T14:20:21.397307Z"}],"euvd":[{"id":"EUVD-2019-6803","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2019-09-03T20:56:18Z","modified":"2024-08-05T01:03:32Z","updated_at":"2026-11-03T02:40:34.136734Z"}],"ghsa":[{"id":"GHSA-3775-frgh-j3vc","title":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An...","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2022-05-24T16:55:23Z","modified":"2023-01-27T05:02:33Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:42:04.146384Z"}],"nvd":[{"id":"CVE-2019-15892","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2019-09-03T21:15:10.953Z","modified":"2026-06-17T02:21:16.657Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:05:25.691233Z"}],"osv":[{"id":"ALPINE-CVE-2019-15892","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2019-09-03T21:15:10.953Z","modified":"2026-09-21T06:17:52.494336936Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"CVE-2019-15892","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2019-09-03T21:15:10.953Z","modified":"2026-10-24T10:30:47.241626769Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"DEBIAN-CVE-2019-15892","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"published","published":"2019-09-03T21:15:10.953Z","modified":"2026-09-21T07:01:12.005185771Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"OESA-2021-1032","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\\r\\n\\r\\n\r\nSecurity Fix(es):\\r\\n\\r\\n\r\nAn issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.(CVE-2019-15892)\\r\\n\\r\\n","status":"published","published":"2021-02-05T11:04:16Z","modified":"2026-08-18T01:15:04.64443649Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHEA-2020:2262","title":"Red Hat Enhancement Advisory: rh-varnish6 bug fix and enhancement update","status":"published","published":"2024-09-13T16:12:06Z","modified":"2026-06-28T10:34:02Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2020:4756","title":"Red Hat Security Advisory: varnish:6 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:23:33Z","modified":"2026-06-28T10:40:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4756","title":"Moderate: varnish:6 security, bug fix, and enhancement update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nThe following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)\n\nSecurity Fix(es):\n\n* varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)\n\n* varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)\n\n* varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:33:31Z","modified":"2026-02-05T05:00:13.787089Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-15892","description":"An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.","status":"withdrawn","published":"2019-09-03T21:15:00Z","modified":"2025-07-16T07:39:42.896934Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"DSA-4514-1","title":"varnish - security update","status":"published","published":"2019-09-04T00:00:00Z","modified":"2026-03-09T02:08:53.487709Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:2184-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-15892: Fixed a potential denial of service by sending crafted HTTP/1 requests (boo#1149382).\n\nNon-security issues fixed:\n\t  \n- Updated the package to release 6.2.1.\n- Added a thread pool watchdog which will restart the worker process if scheduling tasks onto worker threads appears stuck. The new parameter 'thread_pool_watchdog' configures it.\n- Disabled error for clobbering, which caused bogus error in varnishtest.\n","status":"published","published":"2019-09-25T08:18:43Z","modified":"2026-02-04T03:08:56.800907Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2221-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-15892: Fixed a potential denial of service by sending crafted HTTP/1 requests (boo#1149382).\n\nNon-security issues fixed:\n\t  \n- Updated the package to release 6.2.1.\n- Added a thread pool watchdog which will restart the worker process if scheduling tasks onto worker threads appears stuck. The new parameter 'thread_pool_watchdog' configures it.\n- Disabled error for clobbering, which caused bogus error in varnishtest.\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-09-30T14:22:47Z","modified":"2026-02-04T04:14:44.579387Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11493-1","title":"libvarnishapi2-6.6.1-1.2 on GA media","description":"These are all security issues fixed in the libvarnishapi2-6.6.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:29.961442Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2026:10751-1","title":"libvinylapi3-9.0.0-1.1 on GA media","description":"These are all security issues fixed in the libvinylapi3-9.0.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T08:45:57.407348Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}