Varnish Cache Project vulnerabilities

Products

• Cache 14

Newest

• varnish-software varnish cache, varnish enterprise, varnish cache project cache +2 more Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via... CVE-2025-30346 Fix available 5.4 MediumMarch 21, 2025
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• varnish-software varnish cache, varnish cache project cache, debian linux +2 more +4 more An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x... CVE-2022-45060 Fix available 7.5 HighNovember 9, 2022
• varnish cache project cache, fedoraproject fedora +1 more An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request... CVE-2022-45059 Public exploitFix available 7.5 HighNovember 9, 2022
• varnish cache project cache, fedoraproject fedora +1 more In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to... CVE-2022-38150 Fix available 7.5 HighAugust 11, 2022
• varnish-software varnish cache, varnish cache project cache, debian linux +3 more +5 more In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and... CVE-2022-23959 Fix available 9.1 CriticalJanuary 26, 2022
• varnish-cache varnish cache, varnish cache project cache, debian linux +1 more +3 more Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a... CVE-2021-36740 Fix available 6.5 MediumJuly 14, 2021
• varnish cache project cache Varnish HTTP cache before 3.0.4: ACL bug CVE-2013-4090 Fix available 7.5 HighFebruary 12, 2020
• varnish-software varnish cache, varnish cache project cache, debian linux +2 more An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An... CVE-2019-15892 Fix available 7.5 HighSeptember 3, 2019
• varnish-cache varnish, varnish cache project cache, debian linux +2 more vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5... CVE-2017-8807 Fix available 9.1 CriticalNovember 15, 2017
• varnish-cache varnish, varnish cache project cache, varnish-software varnish cache +2 more An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0,... CVE-2017-12425 Fix available 7.5 HighAugust 2, 2017
• debian linux, varnish cache project cache +1 more Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to... CVE-2015-8852 Fix available 7.5 HighApril 21, 2016
• varnish cache project cache varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log... CVE-2013-0345 2.1 LowMay 8, 2014
• varnish-cache varnish, varnish cache project cache +1 more Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash... CVE-2013-4484 Fix available 5.0 MediumNovember 1, 2013