medium5.4
CVE-2025-47905
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product inc…
Impact
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Varnish Cache | Varnish Cache | before 7.6.3 |
| 7.7 | before 7.7.1 | |
| And Varnish Enterprise | before 6.0.13r14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.