Varnish-software Varnish Cache — known CVE vulnerabilities

Every CVE whose affected-product data names Varnish-software Varnish Cache, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2022-23959 — CVSS 9.1 (critical): In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x…
• CVE-2019-15892 — CVSS 7.5 (high): An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote…
• CVE-2019-20637 — CVSS 7.5 (high): An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a…
• CVE-2017-12425 — CVSS 7.5 (high): An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if…
• CVE-2020-11653 — CVSS 7.5 (high): An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. It occurs when…
• CVE-2022-45060 — CVSS 7.5 (high): An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An…
• CVE-2021-36740 — CVSS 6.5 (medium): Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST…