VC
Product
Varnish Cache
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 8Medium 3Low 1
Watch
Add Varnish Cache to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-36740 | 6.5 | Jul 14 | Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request Affected: 6.0.0 through 6.0.5; 6.0.0 through 6.0.7 |
| CVE-2025-47905 | 5.4 | May 13 | Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits… Affected: before 6.0.14 LTS; 7.0.0 before 7.6.3; 7.7.0 before 7.7.1 |
| CVE-2025-30346 | 4.8 | Mar 21 | Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests Affected: 7.5.0 before 7.6.2 |
Showing 3