Varnish Software Varnish Enterprise 6.0.16 R11
Approved changes feed: RSS · Atom
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r11:*:*:*:*:*:*
part: a version: 6.0.16 update: r11
| Vendor | Varnish Software (65ee8e2c-5e48-53f9-a999-99b2a3b7b4f1) |
|---|---|
| Product | Varnish Enterprise (569bafee-eb78-580d-83c5-1206057b9781) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-40395 |
vulnerable | 2026-06-08 08:01:20.504469 |
Details available
MEDIUM (4)
Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.
Published: 2026-04-12T19:21:09.265Z
Updated: 2026-04-13T15:45:30.791Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34475 |
vulnerable | 2026-06-08 07:59:12.603505 |
Details available
MEDIUM (5.4)
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Published: 2026-03-27T19:40:28.397Z
Updated: 2026-03-27T20:01:11.327Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.