{"id":"CVE-2019-20637","aliases":["DEBIAN-CVE-2019-20637","EUVD-2019-11176","GHSA-h2vv-cmjp-m2w5","RHSA-2020:4756","RLSA-2020:4756","UBUNTU-CVE-2019-20637","USN-5474-1","openSUSE-SU-2020:0808-1","openSUSE-SU-2020:0819-1"],"status":"published","title":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3...","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0179,"percentile":0.78551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-212"],"published":"2020-04-08T23:01:30Z","modified":"2026-09-21T07:00:42Z","fixes":[{"ecosystem":"Debian:12","package":"varnish","fixed_in":["6.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["6.4.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"varnish","fixed_in":["5.2.1-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"varnish","fixed_in":["6.2.1-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+179+20b582cc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+179+20b582cc"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.1"}]}],"versions":["5.0.0-7.1","5.2.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.1"}]}],"versions":["6.1.1-1","6.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.1"}]}],"versions":["5.0.0-7.1","5.2.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.1"}]}],"versions":["6.1.1-1","6.2.1-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-1ubuntu0.2"}]}],"versions":["6.5.2-1","6.6.1-1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-lp151.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-bp151.4.6.1"}]}],"bundled":2}],"products":[{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"varnish-cache","product":"varnish_cache"},{"vendor":"varnish-software","product":"varnish_cache"}],"references":[{"url":"http://varnish-cache.org/security/VSV00004.html#vsv00004","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20637","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h2vv-cmjp-m2w5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-20637","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4756","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1756079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813867","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4756.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15892","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15892","tags":["advisory"]},{"url":"https://varnish-cache.org/security/VSV00003.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20637","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11653","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11653","tags":["advisory"]},{"url":"https://varnish-cache.org/security/VSV00005.html#vsv00005","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4756","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20637","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/bd7b3d6d47ccbb5e1747126f8e2a297f38e56b8c","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5474-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-11653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23959","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PCUUXZW2DUUNCOBXQJNOGTFZJED26EJM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169039","tags":["report"]},{"url":"https://bugzilla.suse.com/1169040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11653","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SC6JBGFRDO2KYXWHDNCH6CJL6N7QISZW/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-20637","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2020-04-08T23:01:30Z","modified":"2024-08-05T02:46:10.452Z","updated_at":"2026-11-02T14:20:17.431882Z"}],"euvd":[{"id":"EUVD-2019-11176","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2020-04-08T23:01:30Z","modified":"2024-08-05T02:46:10Z","updated_at":"2026-11-03T02:40:21.253488Z"}],"ghsa":[{"id":"GHSA-h2vv-cmjp-m2w5","title":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3...","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2022-05-24T17:13:55Z","modified":"2023-01-29T05:02:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-212"],"updated_at":"2026-11-02T14:45:03.903455Z"}],"nvd":[{"id":"CVE-2019-20637","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2020-04-08T23:15:12.623Z","modified":"2026-06-17T02:30:51.083Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-212"],"updated_at":"2026-11-02T14:05:46.451008Z"}],"osv":[{"id":"CVE-2019-20637","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2020-04-08T23:15:12.623Z","modified":"2026-03-15T22:28:10.571788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-20637","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2020-04-08T23:15:12.623Z","modified":"2026-09-21T07:00:42.048358453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHSA-2020:4756","title":"Red Hat Security Advisory: varnish:6 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:23:33Z","modified":"2026-06-28T10:40:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4756","title":"Moderate: varnish:6 security, bug fix, and enhancement update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nThe following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)\n\nSecurity Fix(es):\n\n* varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)\n\n* varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)\n\n* varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:33:31Z","modified":"2026-02-05T05:00:13.787089Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-20637","description":"An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.","status":"published","published":"2020-04-08T23:15:00Z","modified":"2026-04-22T12:17:43.421092Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"openSUSE-SU-2020:0808-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\n- CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040)\n- CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039)\n","status":"published","published":"2020-06-13T10:17:05Z","modified":"2026-02-04T03:30:18.727306Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0819-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\n- CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040)\n- CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-06-16T05:51:42Z","modified":"2026-02-04T02:35:06.771404Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"USN-5474-1","title":"varnish vulnerabilities","description":"It was dicovered that Varnish Cache did not clear a pointer between the\nhandling of one client request and the next request within the same connection.\nA remote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2019-20637)\n\nIt was discovered that Varnish Cache could have an assertion failure when a\nTLS termination proxy uses PROXY version 2. A remote attacker could possibly\nuse this issue to restart the daemon and cause a performance loss.\n(CVE-2020-11653)\n\nIt was discovered that Varnish Cache allowed request smuggling and VCL\nauthorization bypass via a large Content-Length header for a POST\nrequest. A remote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2021-36740)\n\nIt was discovered that Varnish Cache allowed request smuggling for HTTP/1\nconnections. A remote attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-23959)\n","status":"published","published":"2022-06-08T19:20:14Z","modified":"2026-04-27T16:19:03.423080578Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}