Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Varnish Cache Servers Can Be Tricked by Malicious Requests
published 3 years ago
Summary
Varnish Cache servers with HTTP/2 turned on may be tricked into sending malicious requests to other servers behind them, potentially allowing an attacker to exploit vulnerabilities in those servers. This issue affects Varnish Cache servers running in a Kubernetes environment. To fix this, update to Varnish 6.0.11 or later, available in kube-httpcache versions v0.7.1 and later, or follow upstream mitigation hints for a workaround.
What to do
- Update github.com mittwald to version 0.7.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | mittwald |
< 0.7.1 Fix: upgrade to 0.7.1
|
Original advisory text
kube-httpcache is vulnerable to Cross-Site Request Forgery (CSRF)
### Impact
> A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.
> -- https://varnish-cache.org/security/VSV00011.html#vsv00011
### Patches
This is fixed in Varnish 6.0.11; Varnish 6.0.11 is available in `kube-httpcache` versions v0.7.1 and later.
### Workarounds
See [upstream mitigation hints](https://varnish-cache.org/security/VSV00011.html#mitigation).
### References
- https://varnish-cache.org/security/VSV00011.html#vsv00011
> A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.
> -- https://varnish-cache.org/security/VSV00011.html#vsv00011
### Patches
This is fixed in Varnish 6.0.11; Varnish 6.0.11 is available in `kube-httpcache` versions v0.7.1 and later.
### Workarounds
See [upstream mitigation hints](https://varnish-cache.org/security/VSV00011.html#mitigation).
### References
- https://varnish-cache.org/security/VSV00011.html#vsv00011
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published2 Dec 2022
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-47xh-qxqv-mgvg · GHSA
Track software like this
Free during beta