{"id":"CVE-2020-11653","aliases":["DEBIAN-CVE-2020-11653","DLA-3208-1","EUVD-2020-3996","GHSA-jg36-89rw-qgr3","RHSA-2020:4756","RLSA-2020:4756","UBUNTU-CVE-2020-11653","USN-5474-1","USN-5474-2","openSUSE-SU-2020:0808-1","openSUSE-SU-2020:0819-1"],"status":"published","title":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3...","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02159,"percentile":0.82435,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-617"],"published":"2020-04-08T00:00:00Z","modified":"2026-10-26T12:01:23Z","fixes":[{"ecosystem":"Debian:12","package":"varnish","fixed_in":["6.4.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["6.4.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"varnish","fixed_in":["6.2.1-2ubuntu0.1","6.2.1-2ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.4.0-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-1+deb10u4"}]}],"versions":["6.1.1-1","6.1.1-1+deb10u1","6.1.1-1+deb10u2","6.1.1-1+deb10u3"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+179+20b582cc"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+179+20b582cc"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.1"}]}],"versions":["6.1.1-1","6.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.1"}]}],"versions":["5.0.0-7.1","5.2.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.1"}]}],"versions":["6.1.1-1","6.2.1-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-1ubuntu0.2"}]}],"versions":["6.5.2-1","6.6.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.2"}]}],"versions":["6.1.1-1","6.2.1-2","6.2.1-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-lp151.3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-bp151.4.6.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"backports_sle"},{"vendor":"opensuse","product":"leap"},{"vendor":"varnish-cache","product":"varnish_cache"},{"vendor":"varnish-software","product":"varnish_cache"}],"references":[{"url":"https://varnish-cache.org/security/VSV00005.html#vsv00005","tags":["x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00031.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00026.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00036.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11653","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jg36-89rw-qgr3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-11653","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4756","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1756079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813867","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4756.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15892","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15892","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15892","tags":["advisory"]},{"url":"https://varnish-cache.org/security/VSV00003.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20637","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20637","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20637","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11653","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11653","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2020:4756","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-11653","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/2d8fc1a784a1e26d78c30174923a2b14ee2ebf62","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5474-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5474-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-36740","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23959","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PCUUXZW2DUUNCOBXQJNOGTFZJED26EJM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1169039","tags":["report"]},{"url":"https://bugzilla.suse.com/1169040","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11653","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/SC6JBGFRDO2KYXWHDNCH6CJL6N7QISZW/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-11653","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2020-04-08T00:00:00Z","modified":"2024-08-04T11:35:13.694Z","updated_at":"2026-11-02T14:35:57.352161Z"}],"euvd":[{"id":"EUVD-2020-3996","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2020-04-08T00:00:00Z","modified":"2024-08-04T11:35:13Z","updated_at":"2026-11-03T03:07:42.866588Z"}],"ghsa":[{"id":"GHSA-jg36-89rw-qgr3","title":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3...","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2022-05-24T17:13:57Z","modified":"2023-01-30T05:06:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-20","CWE-617"],"updated_at":"2026-11-02T14:47:30.041148Z"}],"nvd":[{"id":"CVE-2020-11653","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2020-04-08T23:15:12.73Z","modified":"2026-06-17T02:50:33.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:05:57.678762Z"}],"osv":[{"id":"CVE-2020-11653","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2020-04-08T23:15:12.73Z","modified":"2026-03-15T14:36:39.817405Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.034736Z"},{"id":"DEBIAN-CVE-2020-11653","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2020-04-08T23:15:12.73Z","modified":"2026-10-26T12:01:23.313905945Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"RHSA-2020:4756","title":"Red Hat Security Advisory: varnish:6 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T04:23:33Z","modified":"2026-06-28T10:40:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:4756","title":"Moderate: varnish:6 security, bug fix, and enhancement update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nThe following packages have been upgraded to a later upstream version: varnish (6.0.6). (BZ#1795673)\n\nSecurity Fix(es):\n\n* varnish: denial of service handling certain crafted HTTP/1 requests (CVE-2019-15892)\n\n* varnish: remote clients may cause Varnish to assert and restart which could result in DoS (CVE-2020-11653)\n\n* varnish: not clearing pointer between two client requests leads to information disclosure (CVE-2019-20637)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.","status":"published","published":"2020-11-03T12:33:31Z","modified":"2026-02-05T05:00:13.787089Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-11653","description":"An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when communication with a TLS termination proxy uses PROXY version 2. There can be an assertion failure and daemon restart, which causes a performance loss.","status":"published","published":"2020-04-08T23:15:00Z","modified":"2026-04-22T12:26:15.715425Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"DLA-3208-1","title":"varnish - security update","status":"published","published":"2022-11-27T00:00:00Z","modified":"2026-03-09T01:21:08.224306Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2020:0808-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\n- CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040)\n- CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039)\n","status":"published","published":"2020-06-13T10:17:05Z","modified":"2026-02-04T03:30:18.727306Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0819-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\n- CVE-2019-20637: Fixed an information leak when handling one client request and the next on the same connection (boo#1169040)\n- CVE-2020-11653: Fixed a performance loss due to an assertion failure and daemon restart when communicating with TLS termination proxy that uses PROXY version 2 (boo#1169039)\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.","status":"published","published":"2020-06-16T05:51:42Z","modified":"2026-02-04T02:35:06.771404Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"USN-5474-1","title":"varnish vulnerabilities","description":"It was dicovered that Varnish Cache did not clear a pointer between the\nhandling of one client request and the next request within the same connection.\nA remote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2019-20637)\n\nIt was discovered that Varnish Cache could have an assertion failure when a\nTLS termination proxy uses PROXY version 2. A remote attacker could possibly\nuse this issue to restart the daemon and cause a performance loss.\n(CVE-2020-11653)\n\nIt was discovered that Varnish Cache allowed request smuggling and VCL\nauthorization bypass via a large Content-Length header for a POST\nrequest. A remote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2021-36740)\n\nIt was discovered that Varnish Cache allowed request smuggling for HTTP/1\nconnections. A remote attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-23959)\n","status":"published","published":"2022-06-08T19:20:14Z","modified":"2026-04-27T16:19:03.423080578Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-5474-2","title":"varnish regression","description":"USN-5474-1 fixed vulnerabilities in Varnish Cache. Unfortunately the fix for\nCVE-2020-11653 was incomplete. This update fixes the problem.\n\nOriginal advisory details:\n\n It was discovered that Varnish Cache could have an assertion failure when a\n TLS termination proxy uses PROXY version 2. A remote attacker could possibly\n use this issue to restart the daemon and cause a performance loss.\n (CVE-2020-11653)\n","status":"published","published":"2022-08-23T19:00:19Z","modified":"2026-04-22T10:25:07.719194Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}