CVE-2022-23959
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
- Score
- CVSS 3.1 9.1 Critical
- Status
- Modified - cve@mitre.org
- Published
- 2022-01-26
- Last modified
- 2024-08-03
- Weaknesses
- CWE-444
Affected products
- Debian Linux (Debian)
- Fedora (Fedoraproject)
- Varnich Cache (Varnish-software)
- Varnish Cache (Varnish-software)
- Varnish Cache Plus (Varnish-software)
- Varnish Cache (Varnish Cache Project)
References
- https://docs.varnish-software.com/security/VSV00008/
- https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVA…
- https://varnish-cache.org/security/VSV00008.html
- https://www.debian.org/security/2022/dsa-5088
