{"id":"CVE-2021-36740","aliases":["ALPINE-CVE-2021-36740","BIT-varnish-2021-36740","DEBIAN-CVE-2021-36740","DSA-5088-1","EUVD-2021-23330","GHSA-8vxj-gx32-j925","MGASA-2021-0387","OESA-2021-1374","RHSA-2021:2988","RHSA-2021:2993","RLSA-2021:2988","UBUNTU-CVE-2021-36740","USN-5474-1","openSUSE-SU-2022:0148-1"],"status":"published","title":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a...","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01599,"percentile":0.75952,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2021-07-14T16:07:28Z","modified":"2026-10-24T14:25:14Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"varnish","fixed_in":["6.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"varnish","fixed_in":["6.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"varnish","fixed_in":["6.5.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"varnish","fixed_in":["6.6.1-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"varnish","fixed_in":["5.2.2","6.6.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"varnish","fixed_in":["6.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["6.5.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"varnish","fixed_in":["6.5.1-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"varnish","fixed_in":["6.0.0-9.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP2","package":"varnish","fixed_in":["6.0.0-9.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish","fixed_in":["0:6.0.2-2.module+el8.1.0+11974+ea5ba4f1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-devel","fixed_in":["0:6.0.2-2.module+el8.1.0+11974+ea5ba4f1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-docs","fixed_in":["0:6.0.2-2.module+el8.1.0+11974+ea5ba4f1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish","fixed_in":["0:6.0.2-2.module+el8.2.0+11973+a748eca7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-devel","fixed_in":["0:6.0.2-2.module+el8.2.0+11973+a748eca7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-docs","fixed_in":["0:6.0.2-2.module+el8.2.0+11973+a748eca7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish","fixed_in":["0:6.0.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-devel","fixed_in":["0:6.0.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-docs","fixed_in":["0:6.0.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-libs","fixed_in":["0:6.0.8-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules","fixed_in":["0:0.15.0-7.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules-debuginfo","fixed_in":["0:0.15.0-7.el7"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.3.0+179+20b582cc"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+179+20b582cc"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"varnish","fixed_in":["6.2.1-2ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"varnish","ranges":[{"type":"SEMVER","events":[{"introduced":"5.0.0"},{"fixed":"5.2.2"},{"introduced":"6.1.0"},{"fixed":"6.6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.1-1+deb10u3"}]}],"versions":["6.1.1-1","6.1.1-1+deb10u1","6.1.1-1+deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1+deb11u2"}]}],"versions":["6.5.1-1","6.5.1-1+deb11u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-9.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-9.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.2-2.module+el8.1.0+11974+ea5ba4f1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.2-2.module+el8.1.0+11974+ea5ba4f1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.2-2.module+el8.1.0+11974+ea5ba4f1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.2-2.module+el8.2.0+11973+a748eca7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.2-2.module+el8.2.0+11973+a748eca7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.2-2.module+el8.2.0+11973+a748eca7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-7.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-7.el7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.3.0+179+20b582cc"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+179+20b582cc"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.1"}]}],"versions":["6.1.1-1","6.2.1-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.1-1ubuntu0.1"}]}],"versions":["5.0.0-7.1","5.2.1-1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.1-2ubuntu0.1"}]}],"versions":["6.1.1-1","6.2.1-2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.1-1ubuntu0.2"}]}],"versions":["6.5.2-1","6.6.1-1"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-bp153.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-bp153.2.3.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"varnish-cache","product":"varnish_cache"},{"vendor":"varnish-software","product":"varnish_cache"},{"vendor":"varnish_cache_project","product":"varnish_cache"}],"references":[{"url":"https://varnish-cache.org/security/VSV00007.html","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","advisory","web","article","report"]},{"url":"https://docs.varnish-software.com/security/VSV00007/","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2022/dsa-5088","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-36740","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK/"},{"url":"https://github.com/advisories/GHSA-8vxj-gx32-j925"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-36740","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-36740","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29290","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1374","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2988","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1982409","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2988.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-36740","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-36740","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2993","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2993.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:2988","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-36740","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5474-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-20637","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-23959","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KTY3FIXDKQEQLMHOF4U46AQ47W524UIM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1188470","tags":["report"]},{"url":"https://bugzilla.suse.com/1195188","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23959","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T16:07:28Z","modified":"2024-08-04T01:01:58.991Z","updated_at":"2026-11-02T14:33:06.32268Z"}],"euvd":[{"id":"EUVD-2021-23330","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T16:07:28Z","modified":"2024-08-04T01:01:58Z","updated_at":"2026-11-03T03:24:29.329171Z"}],"ghsa":[{"id":"GHSA-8vxj-gx32-j925","title":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a...","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2022-05-24T19:07:57Z","modified":"2023-01-30T05:00:44Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:46:15.885384Z"}],"nvd":[{"id":"CVE-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T17:15:08.253Z","modified":"2026-06-17T03:59:05.367Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:06:55.747384Z"}],"osv":[{"id":"ALPINE-CVE-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T17:15:08.253Z","modified":"2026-10-23T17:17:56.201519857Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"CVE-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T17:15:08.253Z","modified":"2026-10-24T14:25:14.164029866Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T17:15:08.253Z","modified":"2026-10-23T18:03:29.682095772Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2021-1374","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in Varnish. The Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. As a result, this flaw allows the information on the Varnish cache to be poisoned. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2021-36740)","status":"published","published":"2021-09-30T11:04:38Z","modified":"2026-08-18T01:16:02.896798508Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:2988","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2024-09-13T17:26:13Z","modified":"2026-06-28T10:45:19Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RHSA-2021:2993","title":"Red Hat Security Advisory: rh-varnish6-varnish security update","status":"published","published":"2024-09-13T17:26:21Z","modified":"2026-06-28T10:45:20Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:2988","title":"Important: varnish:6 security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: HTTP/2 request smuggling attack via a large Content-Length header for a POST request (CVE-2021-36740)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-08-02T14:30:38Z","modified":"2026-02-04T23:45:04.552807Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2021-07-14T17:15:00Z","modified":"2026-04-22T12:58:13.18993Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:27.870979Z"},{"id":"BIT-varnish-2021-36740","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.","status":"published","published":"2024-03-06T11:08:33.796Z","modified":"2026-09-08T08:48:21.190079047Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"DSA-5088-1","title":"varnish - security update","status":"published","published":"2022-03-03T00:00:00Z","modified":"2026-03-09T02:11:07.362652Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0387","title":"Updated varnish packages fix a security vulnerability","description":"Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL\nauthorization bypass via a large Content-Length header for a POST request.\nThis affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x\nand 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8\n(CVE-2021-36740).\n","status":"published","published":"2021-07-28T20:00:51Z","modified":"2026-04-16T04:40:57.353431408Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0148-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\nvarnish was updated to release 7.1.0 [boo#1195188] [CVE-2022-23959]\n\n* VCL: It is now possible to assign a BLOB value to a BODY\n  variable, in addition to STRING as before.\n* VMOD: New STRING strftime(TIME time, STRING format) function\n  for UTC formatting.\n\nUpdate to release 6.6.1\n\n* CVE-2021-36740: Fix an HTTP/2.0 request smuggling vulnerability. [boo#1188470]\n\nUpdate to release 6.6.0:\n\n* The ban_cutoff parameter now refers to the overall length of\n  the ban list, including completed bans, where before only\n  non-completed (“active”) bans were counted towards ban_cutoff.\n* Body bytes accounting has been fixed to always represent the\n  number of body bytes moved on the wire, exclusive of\n  protocol-specific overhead like HTTP/1 chunked encoding or\n  HTTP/2 framing.\n* The connection close reason has been fixed to properly report\n  SC_RESP_CLOSE where previously only SC_REQ_CLOSE was reported.\n* Unless the new validate_headers feature is disabled, all newly\n  set headers are now validated to contain only characters\n  allowed by RFC7230.\n* The filter_re, keep_re and get_re functions from the bundled\n  cookie vmod have been changed to take the VCL_REGEX type. This\n  implies that their regular expression arguments now need to be\n  literal, not e.g. string.\n* The interface for private pointers in VMODs has been changed,\n  the VRT backend interface has been changed, many filter\n  (VDP/VFP) related signatures have been changed, and the\n  stevedore API has been changed. (Details thereto, see online\n  changelog.)\n\nUpdate to release 6.5.1\n\n* Bump the VRT_MAJOR_VERSION number defined in the vrt.h\n\nUpdate to release 6.5.0\n\n* `PRIV_TOP` is now thread-safe to support parallel ESI\n  implementations.\n* varnishstat's JSON output format (-j option) has been changed.\n* Behavior for 304-type responses was changed not to update the\n  Content-Encoding response header of the stored object.\n\n- Update Git-Web repository link\n\nUpdate to release 6.4.0\n\n* The MAIN.sess_drop counter is gone.\n* backend 'none' was added for 'no backend'.\n* The hash algorithm of the hash director was changed, so\n  backend selection will change once only when upgrading.\n* It is now possible for VMOD authors to customize the\n  connection pooling of a dynamic backend.\n* For more, see changes.rst.\n\nUpdate to release 6.3.2\n\n* Fix a denial of service vulnerability when using the proxy\n  protocol version 2.\n\nUpdate to release 6.3.0\n\n* The Host: header is folded to lower-case in the builtin_vcl.\n* Improved performance of shared memory statistics counters.\n* Synthetic objects created from vcl_backend_error {} now\n  replace existing stale objects as ordinary backend fetches\n  would (for details see changes.rst)\n","status":"published","published":"2022-05-27T04:23:45Z","modified":"2026-02-04T02:24:01.692209Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"USN-5474-1","title":"varnish vulnerabilities","description":"It was dicovered that Varnish Cache did not clear a pointer between the\nhandling of one client request and the next request within the same connection.\nA remote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2019-20637)\n\nIt was discovered that Varnish Cache could have an assertion failure when a\nTLS termination proxy uses PROXY version 2. A remote attacker could possibly\nuse this issue to restart the daemon and cause a performance loss.\n(CVE-2020-11653)\n\nIt was discovered that Varnish Cache allowed request smuggling and VCL\nauthorization bypass via a large Content-Length header for a POST\nrequest. A remote attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2021-36740)\n\nIt was discovered that Varnish Cache allowed request smuggling for HTTP/1\nconnections. A remote attacker could possibly use this issue to obtain\nsensitive information. (CVE-2022-23959)\n","status":"published","published":"2022-06-08T19:20:14Z","modified":"2026-04-27T16:19:03.423080578Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}