Published: 14/07/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 6.5 | Impact Score: 2.5 | Exploitability Score: 3.9

VMScore: 572

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x prior to 6.0.8r3, and Varnish Cache 5.x and 6.x prior to 6.5.2, 6.6.x prior to 6.6.1, and 6.0 LTS prior to 6.0.8.

Vulnerable Product	Search on Vulmon	Subscribe to Product
varnish-cache varnish cache
varnish-cache varnish cache 6.0.8
varnish cache project varnish cache
varnish-software varnish cache
fedoraproject fedora 33
fedoraproject fedora 34
debian debian linux 10.0
debian debian linux 11.0

Several security issues were fixed in Varnish Cache ...

Brief introduction CVE-2021-36740 Martin Blix Grydeland discovered that Varnish is vulnerable to request smuggling attacks if the HTTP/2 protocol is enabled CVE-2022-23959 James Kettle discovered a request smuggling attack against the HTTP/1 protocol implementation in Varnish For the oldstable distribution (buster), these probl ...

Severity Unknown Remote Unknown Type Unknown Description AVG-2154 varnish 660-2 661-1 Unknown Fixed ...

Varnish HTTP/2 Request Smuggling This repository a docker-compose file to setup a local environment that is vulnerable to CVE-2021-36740 Varnish HTTP/2 request smuggling There is a blog post at labsdetectifycom/2021/08/26/how-to-set-up-docker-for-varnish-http-2-request-smuggling/ describing the vulnerability and the test environment The basis for this local environm

Awesome Vulnerable Applications A curated list of various vulnerable by design applications Contents Online Paid Vulnerable VMs Cloud Security SSO - Single Sign On Mobile Security OWASP Top 10 SQL Injection XSS Injection Server Side Request Forgery CORS Misconfiguration XXE Injection Request Smuggling Technologies WordPress Nodejs Firmware Uncategorized Online Onli

Awesome Vulnerable Applications

Awesome Vulnerable Applications A curated list of various vulnerable by design applications Contents Online Paid Vulnerable VMs Cloud Security SSO - Single Sign On Mobile Security OWASP Top 10 SQL Injection XSS Injection Server Side Request Forgery CORS Misconfiguration XXE Injection Request Smuggling Technologies WordPress Nodejs Firmware Uncategorized Online Onli

A web challenge for CNSS Recruit 2022(CTF).

cn55spider This repo includes the source code of CNSS Recruit 2022 web challenge named cn55spider 前言写给招新赛的 Web 压轴题，由于本人比较懒惰倦怠，只出了这一道 Web 缝合套娃题，甚至一度觉得难度没有学弟出的内网题目难度大编排过程中的 idea 几乎都是参考现成赛事加以个人的拙劣魔改（鉴定为会搜�

Awesome Vulnerable Applications A curated list of various vulnerable by design applications Contents Online Paid Vulnerable VMs Cloud Security SSO - Single Sign On Mobile Security OWASP Top 10 SQL Injection XSS Injection Server Side Request Forgery CORS Misconfiguration XXE Injection Request Smuggling Technologies WordPress Nodejs Firmware Uncategorized Online Onli

CWE-444 https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf https://docs.varnish-software.com/security/VSV00007/https://varnish-cache.org/security/VSV00007.html https://www.debian.org/security/2022/dsa-5088 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/https://ubuntu.com/security/notices/USN-5474-1 https://nvd.nist.gov

CVE-2021-36740

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect