GCVE - cpe:2.3:a:varnish_cache_project:varnish

Approved changes feed: RSS · Atom

cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Varnish Cache Project (`c1e10bbf-7d38-508b-a301-520934fa3e6c`)
Product	Varnish Cache (`3c323b6b-d34f-5f8e-b7b4-5d7b5a006e19`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/varnishcache/varnish-cache`	purl2cpe	2026-06-01 10:17:47.240328

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-30346`	vulnerable	2026-06-08 07:16:59.776051	Details available MEDIUM (5.4) Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. Published: 2025-03-21T00:00:00.000Z Updated: 2025-04-03T13:05:21.274Z Open on db.gcve.eu Reference links https://varnish-cache.org/security/VSV00015.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-44487`	vulnerable	2026-06-08 06:12:41.197261	Details available The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. Published: 2023-10-10T00:00:00.000Z Updated: 2026-10-14T23:51:51.782Z Open on db.gcve.eu Reference links https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73 https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/ https://aws.amazon.com/security/security-bulletins/AWS-2023-011/ https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-45060`	vulnerable	2026-06-08 05:50:35.503297	Details available An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected. Published: 2022-11-09T00:00:00.000Z Updated: 2025-05-01T14:28:59.931Z Open on db.gcve.eu Reference links https://varnish-cache.org/security/VSV00011.html https://docs.varnish-software.com/security/VSV00011 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-45059`	vulnerable	2026-06-08 05:50:35.454550	Details available An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend. Published: 2022-11-09T00:00:00.000Z Updated: 2025-05-01T14:30:34.031Z Open on db.gcve.eu Reference links https://varnish-cache.org/security/VSV00010.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-23959`	vulnerable	2026-06-08 05:40:59.396175	Details available In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections. Published: 2022-01-26T00:38:55.000Z Updated: 2024-08-03T03:59:23.263Z Open on db.gcve.eu Reference links https://varnish-cache.org/security/VSV00008.html https://docs.varnish-software.com/security/VSV00008/ https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/ https://www.debian.org/security/2022/dsa-5088	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36740`	vulnerable	2026-06-08 05:32:52.388177	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2019-15892`	vulnerable	2026-06-08 05:12:58.182985	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-8807`	vulnerable	2026-06-08 05:10:08.928367	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4484`	vulnerable	2026-06-08 05:04:47.289165	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4090`	vulnerable	2026-06-08 05:04:33.784298	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Varnish Cache

Notes

PURL mappings

Vulnerability references

Contribute