Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2022-45059: Varnish Cache 7.x: Request Smuggling Allows Header Manipulation
CVE-2022-45059 · published 3 years ago
Summary
Varnish Cache servers are at risk of being tricked into manipulating HTTP headers. This could allow attackers to control how requests are handled by the server. To fix this, update to Varnish Cache version 7.1.2 or later for version 7.x, or version 7.2.1 or later for version 7.2.x.
What to do
- Update debian varnish to version 7.1.1-1.1.
- Update varnish_cache_project varnish_cache to version 7.1.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | varnish |
< 7.1.1-1.1 Fix: upgrade to 7.1.1-1.1
|
| Debian:13 | debian | varnish |
< 7.1.1-1.1 Fix: upgrade to 7.1.1-1.1
|
| – | varnish_cache_project | varnish_cache |
>= 7.0.0, < 7.1.2 7.2.0 cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
35 36 37 cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made ho...
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-45059 Vendor Advisory
- https://varnish-cache.org/security/VSV00010.html URL
- https://security-tracker.debian.org/tracker/CVE-2022-45059 Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45059... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published9 Nov 2022
Updated31 Oct 2026
First seen12 May 2026
Track software like this
Free during beta