{"id":"CVE-2024-30156","aliases":["ALPINE-CVE-2024-30156","ALSA-2024:1690","ALSA-2024:1691","CLSA-2025-1763374645","DEBIAN-CVE-2024-30156","EUVD-2024-28092","GHSA-c3wj-m54r-wfgq","MGASA-2024-0124","OESA-2024-1415","RHSA-2024:1689","RHSA-2024:1690","RHSA-2024:1691","RHSA-2024:2700","RHSA-2024:2820","RHSA-2024:2938","RHSA-2024:3305","RHSA-2024:3426","RHSA-2024:4937","RLSA-2024:1690","RLSA-2024:1691","ROOT-OS-DEBIAN-12-CVE-2024-30156","UBUNTU-CVE-2024-30156"],"status":"published","title":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise...","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.03663,"percentile":0.8973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2024-03-24T00:00:00Z","modified":"2026-11-02T12:02:15Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"varnish","fixed_in":["7.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"varnish","fixed_in":["7.3.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"varnish","fixed_in":["7.4.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"varnish","fixed_in":["7.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"varnish","fixed_in":["7.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"varnish","fixed_in":["7.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"varnish","fixed_in":["7.5.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"varnish","fixed_in":["7.5.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish","fixed_in":["6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish-devel","fixed_in":["6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish-docs","fixed_in":["6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish-modules","fixed_in":["0.15.0-6.module_el8.5.0+2620+03a0c2cc","0.15.0-6.module_el8.5.0+76+a10ffa55","0.15.0-6.module_el8.6.0+3089+dac88e97"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"varnish","fixed_in":["6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"varnish-devel","fixed_in":["6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"varnish-docs","fixed_in":["6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["7.5.0-1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"varnish","fixed_in":["7.3.2-1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"varnish","fixed_in":["7.4.3-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-1.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"varnish","fixed_in":["7.4.3-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"varnish","fixed_in":["7.4.3-1.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"varnish","fixed_in":["7.4.3-1.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","fixed_in":["7.4.3-1.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish","fixed_in":["0:6.0.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-devel","fixed_in":["0:6.0.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-docs","fixed_in":["0:6.0.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-libs","fixed_in":["0:6.0.13-1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules","fixed_in":["0:0.15.0-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules-debuginfo","fixed_in":["0:0.15.0-8.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","fixed_in":["0:6.0.13-1.module+el8.9.0+21617+7578fa11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","fixed_in":["0:6.0.13-1.module+el8.9.0+21617+7578fa11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","fixed_in":["0:6.0.13-1.module+el8.9.0+21617+7578fa11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.9.0+21617+7578fa11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.9.0+21617+7578fa11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.9.0+21617+7578fa11"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish","fixed_in":["0:6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"varnish-devel","fixed_in":["0:6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"varnish","fixed_in":["0:6.6.2-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::crb","package":"varnish-devel","fixed_in":["0:6.6.2-2.el9_0.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish","fixed_in":["0:6.6.2-3.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-3.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"varnish-devel","fixed_in":["0:6.6.2-3.el9_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish","fixed_in":["0:6.0.8-3.module+el8.8.0+21796+79393093.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-devel","fixed_in":["0:6.0.8-3.module+el8.8.0+21796+79393093.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-docs","fixed_in":["0:6.0.8-3.module+el8.8.0+21796+79393093.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish","fixed_in":["0:6.0.8-2.module+el8.6.0+21852+17475f6a.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-devel","fixed_in":["0:6.0.8-2.module+el8.6.0+21852+17475f6a.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-docs","fixed_in":["0:6.0.8-2.module+el8.6.0+21852+17475f6a.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish","fixed_in":["0:6.0.6-1.module+el8.2.0+22154+6b906702"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-1.module+el8.2.0+22154+6b906702"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-1.module+el8.2.0+22154+6b906702"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"varnish","fixed_in":["0:6.0.13-1.module+el8.9.0+1777+0acf9965"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+677+2a78a869"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"varnish","fixed_in":["0:6.6.2-4.el9_3.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"varnish","fixed_in":["7.1.1-2+deb12u1.root.io.2","7.1.1-2+deb12u1.root.io.6","7.1.1-2+deb12u1.root.io.4","7.1.1-2+deb12u1.root.io.1","7.1.1-2+deb12u1.root.io.3","7.1.1-2+deb12u1.root.io.5","7.1.1-2+deb12u1.root.io.7","7.1.1-2+deb12u1.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-varnish","fixed_in":["7.1.1-2+deb12u1.root.io.2","7.1.1-2+deb12u1.root.io.6","7.1.1-2+deb12u1.root.io.4","7.1.1-2+deb12u1.root.io.1","7.1.1-2+deb12u1.root.io.3","7.1.1-2+deb12u1.root.io.5","7.1.1-2+deb12u1.root.io.7","7.1.1-2+deb12u1.aikido.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-6.module_el8.5.0+2620+03a0c2cc"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-6.module_el8.5.0+76+a10ffa55"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-6.module_el8.6.0+3089+dac88e97"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-3.el9_2.1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-3.el9_2.1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-3.el9_2.1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2","7.1.1-2+deb12u1","7.5.0-1","7.5.0-2","7.5.0-3","7.6.0-1","7.6.0-2","7.6.1-1","7.6.1-2","7.7.0-1","7.7.0-2","7.7.0-3","7.7.1-1","7.7.2-1","7.7.2-2","7.7.3-1","7.7.3-2","7.7.3-3"]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.2-1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-1.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-1.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-1.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-1.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-varnish6-varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-8.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.9.0+21617+7578fa11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.9.0+21617+7578fa11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.9.0+21617+7578fa11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.9.0+21617+7578fa11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.9.0+21617+7578fa11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.9.0+21617+7578fa11"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::crb","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-2.el9_0.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-3.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-3.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-3.el9_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+21799+2c737c67.5"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-3.module+el8.8.0+21796+79393093.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-3.module+el8.8.0+21796+79393093.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-3.module+el8.8.0+21796+79393093.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+21852+17475f6a.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+21852+17475f6a.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+21852+17475f6a.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.module+el8.2.0+22154+6b906702"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.module+el8.2.0+22154+6b906702"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.module+el8.2.0+22154+6b906702"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.9.0+1777+0acf9965"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+677+2a78a869"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-4.el9_3.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1.root.io.2"},{"fixed":"7.1.1-2+deb12u1.root.io.6"},{"fixed":"7.1.1-2+deb12u1.root.io.4"},{"fixed":"7.1.1-2+deb12u1.root.io.1"},{"fixed":"7.1.1-2+deb12u1.root.io.3"},{"fixed":"7.1.1-2+deb12u1.root.io.5"},{"fixed":"7.1.1-2+deb12u1.root.io.7"},{"fixed":"7.1.1-2+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1.root.io.2"},{"fixed":"7.1.1-2+deb12u1.root.io.6"},{"fixed":"7.1.1-2+deb12u1.root.io.4"},{"fixed":"7.1.1-2+deb12u1.root.io.1"},{"fixed":"7.1.1-2+deb12u1.root.io.3"},{"fixed":"7.1.1-2+deb12u1.root.io.5"},{"fixed":"7.1.1-2+deb12u1.root.io.7"},{"fixed":"7.1.1-2+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.6.1-1","6.6.1-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1ubuntu1"]}],"references":[{"url":"https://varnish-cache.org/security/VSV00014.html","tags":["x_transferred","web","article","report"]},{"url":"https://varnish-cache.org/docs/7.5/whats-new/changes-7.5.html#security","tags":["x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30156","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c3wj-m54r-wfgq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2024-30156","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1690","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-30156","tags":["report"]},{"url":"https://bugzilla.redhat.com/2271486","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-1690.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1691","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-1691.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1763374645.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-30156","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0124.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33084","tags":["report"]},{"url":"https://lwn.net/Articles/969301/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1415","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:1689","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2271486","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1689.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-30156","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1690.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1691.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2700","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2700.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2820","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2820.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2938","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2938.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3305","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3305.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:3426","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3426.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:4937","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4937.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1690","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:1691","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-30156","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-30156","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T00:00:00Z","modified":"2024-11-21T19:12:19.27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:07.482552Z"}],"euvd":[{"id":"EUVD-2024-28092","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T00:00:00Z","modified":"2024-11-21T19:12:19Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:52.116962Z"}],"ghsa":[{"id":"GHSA-c3wj-m54r-wfgq","title":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise...","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T03:30:44Z","modified":"2024-11-21T21:34:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:58:54.226272Z"}],"nvd":[{"id":"CVE-2024-30156","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T01:15:45.53Z","modified":"2026-06-17T07:26:22.793Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:09:43.052376Z"}],"osv":[{"id":"ALPINE-CVE-2024-30156","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T01:15:45.53Z","modified":"2026-11-02T11:17:50.086880957Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"DEBIAN-CVE-2024-30156","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T01:15:45.53Z","modified":"2026-11-02T12:02:15.235100926Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2024-1415","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\r\n\r\nVarnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.(CVE-2024-30156)","status":"published","published":"2024-04-12T11:06:51Z","modified":"2026-08-18T01:18:21.349061207Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:1689","title":"Red Hat Security Advisory: rh-varnish6-varnish security update","status":"published","published":"2024-09-13T21:31:04Z","modified":"2026-06-29T10:56:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1690","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2024-09-13T21:31:14Z","modified":"2026-06-29T10:56:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:1691","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2024-09-13T21:31:23Z","modified":"2026-06-29T10:56:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RHSA-2024:2700","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2024-09-13T21:31:41Z","modified":"2026-06-29T10:57:37Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2820","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2024-09-13T21:31:50Z","modified":"2026-06-29T10:57:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2938","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2024-09-13T21:32:10Z","modified":"2026-06-29T10:58:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3305","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2024-09-13T21:32:30Z","modified":"2026-06-29T10:58:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:3426","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2024-09-13T21:31:05Z","modified":"2026-06-29T10:58:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:4937","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2024-09-13T21:33:06Z","modified":"2026-06-29T10:59:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:14.03234Z"},{"id":"UBUNTU-CVE-2024-30156","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T01:15:00Z","modified":"2026-04-22T14:44:05.169829Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"ALSA-2024:1690","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-04-08T00:00:00Z","modified":"2026-10-29T11:02:27.699525437Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:1691","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.","status":"published","published":"2024-04-08T00:00:00Z","modified":"2026-10-29T11:31:05.909224761Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2025-1763374645","title":"varnish: Fix of 2 CVEs","description":"- CVE-2024-30156: fix HTTP/2 flow control vulnerability allowing window credit\n  exhaustion (Broke Window Attack) causing potential denial of service\n- CVE-2025-47905: fix client-side request smuggling via malformed HTTP/1 chunked\n  requests","status":"published","published":"2025-11-17T10:17:29Z","modified":"2026-06-01T00:31:26.787768643Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CVE-2024-30156","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.","status":"published","published":"2024-03-24T01:15:45Z","modified":"2026-04-16T04:37:50.473111527Z","updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"MGASA-2024-0124","title":"Updated varnish packages fix security vulnerability","description":"Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13\nLTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits\nexhaustion for an HTTP/2 connection control flow window, aka a Broke\nWindow Attack. (CVE-2024-30156)\n","status":"published","published":"2024-04-12T20:45:19Z","modified":"2026-04-16T04:40:55.092034605Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"RLSA-2024:1690","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-06T13:04:21.002456Z","modified":"2026-02-04T12:45:13.366123Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2024:1691","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section.","status":"published","published":"2024-05-10T14:32:38.11477Z","modified":"2026-02-04T14:45:04.473233Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2024-30156","title":"CVE-2024-30156 in varnish - Patched by Root","description":"Root has patched CVE-2024-30156 in the varnish package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-26T07:38:20Z","modified":"2026-08-26T09:00:04.105383603Z","updated_at":"2026-11-02T15:53:30.70924Z"}]}}