{"id":"CVE-2025-47905","aliases":["ALPINE-CVE-2025-47905","ALSA-2025:8336","ALSA-2025:8337","ALSA-2025:8550","BIT-varnish-2025-47905","CLSA-2025-1763374645","DEBIAN-CVE-2025-47905","DLA-4187-1","DSA-5918-1","EUVD-2025-14634","GHSA-cvpp-rmjx-5x2m","OESA-2025-1556","RHSA-2025:8294","RHSA-2025:8310","RHSA-2025:8336","RHSA-2025:8337","RHSA-2025:8339","RHSA-2025:8340","RHSA-2025:8349","RHSA-2025:8350","RHSA-2025:8351","RHSA-2025:8550","RLSA-2025:8336","RLSA-2025:8337","RLSA-2025:8550","UBUNTU-CVE-2025-47905"],"status":"published","title":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow...","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00367,"percentile":0.30936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2025-05-13T00:00:00Z","modified":"2026-10-29T11:58:18Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"varnish","fixed_in":["7.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"varnish","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"varnish","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"varnish","fixed_in":["7.7.1-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish","fixed_in":["6.0.13-1.module_el8.10.0+4003+9759c3c1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish-devel","fixed_in":["6.0.13-1.module_el8.10.0+4003+9759c3c1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish-docs","fixed_in":["6.0.13-1.module_el8.10.0+4003+9759c3c1.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"varnish-modules","fixed_in":["0.15.0-6.module_el8.9.0+3826+307eaba4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"varnish","fixed_in":["6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"varnish-devel","fixed_in":["6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"varnish-docs","fixed_in":["6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"varnish","fixed_in":["7.6.1-2.el10_0.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"varnish-devel","fixed_in":["7.6.1-2.el10_0.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"varnish-docs","fixed_in":["7.6.1-2.el10_0.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"varnish","fixed_in":["6.6.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"varnish","fixed_in":["7.1.1-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["7.7.0-2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"varnish","fixed_in":["6.5.1-1+deb11u5"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-3.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"varnish","fixed_in":["7.4.3-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","fixed_in":["7.4.3-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","fixed_in":["7.4.3-3.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish","fixed_in":["0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-devel","fixed_in":["0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-docs","fixed_in":["0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-devel","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-docs","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-devel","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-docs","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-devel","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-docs","fixed_in":["0:6.0.8-2.module+el8.6.0+23122+0639db89.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.5.0+11976+0b4af72d"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","fixed_in":["0:6.0.13-1.module+el8.10.0+23111+831cc069.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","fixed_in":["0:6.0.13-1.module+el8.10.0+23111+831cc069.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","fixed_in":["0:6.0.13-1.module+el8.10.0+23111+831cc069.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.10.0+21682+bcdd3a30"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-6.module+el8.10.0+21682+bcdd3a30"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-6.module+el8.10.0+21682+bcdd3a30"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish","fixed_in":["0:6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"varnish-devel","fixed_in":["0:6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish","fixed_in":["0:6.0.6-1.module+el8.2.0+23124+897a7786.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-1.module+el8.2.0+23124+897a7786.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-1.module+el8.2.0+23124+897a7786.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-4.module+el8+2481+4078e9d2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-devel","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-docs","fixed_in":["0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debuginfo","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debugsource","fixed_in":["0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"varnish","fixed_in":["0:6.6.2-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"varnish-devel","fixed_in":["0:6.6.2-5.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"varnish","fixed_in":["0:6.6.2-2.el9_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-2.el9_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish","fixed_in":["0:6.6.2-3.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish-docs","fixed_in":["0:6.6.2-3.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"varnish-devel","fixed_in":["0:6.6.2-3.el9_2.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"varnish","fixed_in":["0:7.6.1-2.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"varnish-docs","fixed_in":["0:7.6.1-2.el10_0.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.0","package":"varnish-devel","fixed_in":["0:7.6.1-2.el10_0.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"varnish","fixed_in":["0:6.0.13-1.module+el8.10.0+1982+334a201b.1","0:6.0.13-1.module+el8.9.0+1777+0acf9965"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"varnish-modules","fixed_in":["0:0.15.0-6.module+el8.5.0+677+2a78a869"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"varnish","fixed_in":["0:6.6.2-6.el9_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"varnish","fixed_in":["0:7.6.1-2.el10_0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.1-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.module_el8.10.0+4003+9759c3c1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.module_el8.10.0+4003+9759c3c1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.13-1.module_el8.10.0+4003+9759c3c1.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.0-6.module_el8.9.0+3826+307eaba4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"varnish","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.6.2"},{"introduced":"7.0.0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-3.el9_2.1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-3.el9_2.1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.2-3.el9_2.1.tuxcare.els1"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2"]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-2"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1+deb11u5"}]}],"versions":["6.5.1-1","6.5.1-1+deb11u1","6.5.1-1+deb11u2","6.5.1-1+deb11u3","6.5.1-1+deb11u4"]},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2"],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-3.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-3.module+el8.8.0+23121+d8c7990e.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.8-2.module+el8.6.0+23122+0639db89.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+11976+0b4af72d"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.10.0+23111+831cc069.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.10.0+23111+831cc069.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.10.0+23111+831cc069.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.10.0+21682+bcdd3a30"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.10.0+21682+bcdd3a30"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.10.0+21682+bcdd3a30"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.module+el8.2.0+23124+897a7786.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.module+el8.2.0+23124+897a7786.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-1.module+el8.2.0+23124+897a7786.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-4.module+el8+2481+4078e9d2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.6-2.module+el8.4.0+23123+54dbaab7.6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"varnish-modules-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-5.module+el8.3.0+6843+b3b42fcc"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::crb","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-5.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-2.el9_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-2.el9_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-3.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-3.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::crb","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-3.el9_2.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"varnish-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.0","package":"varnish-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.10.0+1982+334a201b.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.0.13-1.module+el8.9.0+1777+0acf9965"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"varnish-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.0-6.module+el8.5.0+677+2a78a869"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.6.2-6.el9_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.6.1-2.el10_0.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-1ubuntu1","3.0.4-1ubuntu2","3.0.5-1ubuntu2","3.0.5-2","3.0.5-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-1","4.1.0-1","4.1.0-2","4.1.1-1","4.1.1-1ubuntu0.2","4.1.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-7.1","5.2.1-1","5.2.1-1ubuntu0.1","5.2.1-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1-1","6.2.1-2","6.2.1-2ubuntu0.1~esm1","6.2.1-2ubuntu0.1~esm2","6.2.1-2ubuntu0.1","6.2.1-2ubuntu0.2","6.2.1-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.6.1-1","6.6.1-1ubuntu0.2","6.6.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1ubuntu1"]}],"products":[{"vendor":"varnish-software","product":"varnish cache"}],"references":[{"url":"https://varnish-cache.org/security/VSV00016.html","tags":["web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/05/15/2","tags":["web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47905","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cvpp-rmjx-5x2m"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-47905","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8336","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-47905","tags":["report"]},{"url":"https://bugzilla.redhat.com/2364235","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-8336.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8337","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2025-8337.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8550","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2025-8550.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1763374645.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-47905","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1556","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8294","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2364235","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8294.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-47905","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8310","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8310.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8336.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8337.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8339","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8339.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8340","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8340.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8349","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8349.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8350","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8350.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:8351","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8351.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_8550.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8336","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8337","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:8550","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-47905","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/b5f1faba6e8d9848cfe0cba566986e7e5cc5f65b","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/13904252859cf9848db5999b08c42d83a03ed812","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/3d9a9abff1c6734feea9d48d5852ccad7e7d0a42","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/00cb14931a53efafbdfec9843453fb1347bc9f59","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T00:00:00Z","modified":"2025-05-29T09:03:18.582Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-14634","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T00:00:00Z","modified":"2025-05-29T09:03:18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:36.215224Z"}],"ghsa":[{"id":"GHSA-cvpp-rmjx-5x2m","title":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow...","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-14T00:32:21Z","modified":"2025-05-29T09:32:01Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:02:29.606493Z"}],"nvd":[{"id":"CVE-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T22:15:24.99Z","modified":"2026-06-17T09:28:49.247Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:11:08.321805Z"}],"osv":[{"id":"ALPINE-CVE-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T22:15:24.99Z","modified":"2026-08-27T22:18:02.913963169Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"DEBIAN-CVE-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T22:15:24.99Z","modified":"2026-09-01T20:05:52.960293272Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"OESA-2025-1556","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nVarnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.(CVE-2025-47905)","status":"published","published":"2025-05-23T11:08:39Z","modified":"2026-08-18T01:17:58.832296894Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"RHSA-2025:8294","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2025-05-29T10:03:35Z","modified":"2026-07-12T10:06:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8310","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2025-05-30T10:03:21Z","modified":"2026-07-12T10:06:47Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8336","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2025-06-02T10:02:10Z","modified":"2026-07-12T10:06:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8337","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2025-06-02T10:02:10Z","modified":"2026-07-12T10:06:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8339","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2025-06-02T10:02:11Z","modified":"2026-07-12T10:06:49Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8340","title":"Red Hat Security Advisory: varnish:6 security update","status":"published","published":"2025-06-02T10:02:11Z","modified":"2026-07-12T10:06:50Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8349","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2025-06-02T10:02:16Z","modified":"2026-07-12T10:06:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8350","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2025-06-02T10:02:17Z","modified":"2026-07-12T10:06:51Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8351","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2025-06-02T10:02:18Z","modified":"2026-07-12T10:06:52Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RHSA-2025:8550","title":"Red Hat Security Advisory: varnish security update","status":"published","published":"2025-06-05T10:04:35Z","modified":"2026-07-12T10:06:54Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:17.634515Z"},{"id":"RLSA-2025:8336","title":"Important: varnish:6 security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: request smuggling attacks (CVE-2025-47905)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-07-29T13:38:41.630147Z","modified":"2025-07-29T15:00:10.23868Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8337","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: request smuggling attacks (CVE-2025-47905)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-04T00:11:30.91642Z","modified":"2025-10-04T00:50:05.701616Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2025:8550","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.\n\nSecurity Fix(es):\n\n* varnish: request smuggling attacks (CVE-2025-47905)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-10-03T19:56:45.27031Z","modified":"2025-10-08T17:12:41.769966Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T22:15:00Z","modified":"2026-04-22T16:03:39.551908Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"ALSA-2025:8336","title":"Important: varnish:6 security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.  \n\nSecurity Fix(es):  \n\n  * varnish: request smuggling attacks (CVE-2025-47905)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-10-29T11:02:23.194029525Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8337","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.  \n\nSecurity Fix(es):  \n\n  * varnish: request smuggling attacks (CVE-2025-47905)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-02T00:00:00Z","modified":"2026-10-29T11:32:29.981269307Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2025:8550","title":"Important: varnish security update","description":"Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.  \n\nSecurity Fix(es):  \n\n  * varnish: request smuggling attacks (CVE-2025-47905)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-06-04T00:00:00Z","modified":"2026-10-29T11:58:18.146662Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"BIT-varnish-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-28T11:59:55.247Z","modified":"2025-05-30T06:16:06.723Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"CLSA-2025-1763374645","title":"varnish: Fix of 2 CVEs","description":"- CVE-2024-30156: fix HTTP/2 flow control vulnerability allowing window credit\n  exhaustion (Broke Window Attack) causing potential denial of service\n- CVE-2025-47905: fix client-side request smuggling via malformed HTTP/1 chunked\n  requests","status":"published","published":"2025-11-17T10:17:29Z","modified":"2026-06-01T00:31:26.787768643Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CVE-2025-47905","description":"Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.","status":"published","published":"2025-05-13T22:15:24Z","modified":"2026-04-10T05:27:50.189237Z","updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DLA-4187-1","title":"varnish - security update","status":"published","published":"2025-05-28T00:00:00Z","modified":"2026-03-09T01:23:26.191521Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5918-1","title":"varnish - security update","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-03-09T02:11:32.798045Z","updated_at":"2026-11-02T15:46:18.296714Z"}]}}