NetSight
IP …
critical9.1

CVE-2022-23959

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.…

Impact

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Affected products

VendorProductAffected versions
Varnish-SoftwareVarnich Cache
from 1.0.0 before 6.6.2
from 4.1.1 before 4.1.11r6
Version 4.1
Varnish-SoftwareVarnish Cache
from 6.0.0 before 6.0.10
Varnish-SoftwareVarnish Cache Plus
from 6.0.0 before 6.0.9r4
Varnish Cache ProjectVarnish Cache
from 7.0.0 before 7.0.2
FedoraprojectFedora
Version 35
DebianDebian Linux
Versions 9.0, 10.0, 11.0

Weakness classification

CWE-444

References