CVE-2022-23959
- Source
- https://cve.org/CVERecord?id=CVE-2022-23959
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23959.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-23959
- Aliases
- Downstream
- Related
- Published
- 2022-01-26T01:15:07.900Z
- Modified
- 2026-04-16T04:36:19.421884975Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
- References
-
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/
- https://varnish-cache.org/security/VSV00008.html
- https://www.debian.org/security/2022/dsa-5088
- https://docs.varnish-software.com/security/VSV00008/
- https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html
Affected packages
Git / github.com/varnishcache/varnish-cache
Affected ranges
- Type
- GIT
- Repo
- https://github.com/varnishcache/varnish-cache
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroduced0 Unknown introduced commit / All previous commits are affectedLast affectedIntroducedFixedIntroducedFixed
- Database specific
{ "versions": [ { "introduced": "1.0.0" }, { "fixed": "6.6.2" }, { "introduced": "0" }, { "last_affected": "4.1" }, { "introduced": "6.0.0" }, { "fixed": "6.0.10" }, { "introduced": "7.0.0" }, { "fixed": "7.0.2" } ] }
Affected versions
varnish-4.*
varnish-4.0.0
varnish-4.0.0-beta1
varnish-4.0.0-tp1
varnish-4.0.0-tp2
varnish-4.0.1
varnish-4.1.0
varnish-4.1.0-beta1
varnish-6.*
varnish-6.0.0
varnish-6.0.1
varnish-6.0.2
varnish-6.0.3
varnish-6.0.4
varnish-6.0.5
varnish-6.0.6
varnish-6.0.7
varnish-6.0.8
varnish-6.0.9
varnish-6.1.0
varnish-6.4.0
varnish-6.5.0
varnish-6.5.1
varnish-6.6.0
varnish-6.6.1
varnish-7.*
varnish-7.0.0
varnish-7.0.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-23959.json"
unresolved_ranges
[
{
"events": [
{
"introduced": "4.1.1"
},
{
"fixed": "4.1.11r6"
}
]
},
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.9r4"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "10.0"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "11.0"
}
]
}
]