| Package | Affected versions | Patched versions |
|---|---|---|
| varnish cache | = 6.0.8≥ 6.0.0, < 6.0.8 | 6.0.8 |
| varnish cache | ≥ 6.0.0, ≤ 6.0.5≥ 6.0.0, ≤ 6.0.7 | |
| varnish cache | ≥ 5.0.0, ≤ 5.2.1≥ 6.1.0, ≤ 6.6.0 |
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free