Skip to content
Fencer Vulns
critical 9.1

CVE-2022-23959 json

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x befo…

published 2022-01-26 4 y ago modified 2026-09-08 2 mo ago also BIT-varnish-2022-23959 , EUVD-2022-28875

cvss
9.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Patch / fix

  • bitnami varnish 7.0.2
  • varnish-software varnich_cache 4.1.11r6, 6.6.2
  • varnish-software varnish_cache 6.0.10
  • varnish-software varnish_cache_plus 6.0.9r4
  • varnish_cache_project varnish_cache 7.0.2
  • varnish Debian 13, Debian 12 7.1.0-5

debian advisories DEBIAN-CVE-2022-23959

  • varnish Ubuntu 18.04 LTS 5.2.1-1ubuntu0.1
  • varnish Ubuntu 20.04 LTS 6.2.1-2ubuntu0.1
  • varnish Ubuntu 22.04 LTS 6.6.1-1ubuntu0.2

ubuntu advisories UBUNTU-CVE-2022-23959

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-varnish6-varnish RHEL 3 SOFTWARE_COLLECTIONS 6.0.8-2.el7.1
  • rh-varnish6-varnish-libs RHEL 3 SOFTWARE_COLLECTIONS 6.0.8-2.el7.1
  • varnish RHEL 8 6.0.8-1.module+el8.5.0+14089+03a0c2cc.1
  • varnish-modules RHEL 8 0.15.0-6.module+el8.5.0+11976+0b4af72d
  • varnish RHEL 8.2 EUS 6.0.2-2.module+el8.2.0+14091+b587eafb.1
  • varnish-modules RHEL 8.2 EUS, RHEL 8.1 E4S 0.15.0-4.module+el8+2481+4078e9d2
  • varnish RHEL 8.1 E4S 6.0.2-2.module+el8.1.0+14093+aa8ea65f.1
  • varnish RHEL 8.4 EUS 6.0.6-2.module+el8.4.0+14090+331e4860.2

red hat advisories RHSA-2022:4745RHSA-2022:0421RHSA-2022:0420RHSA-2022:0422RHSA-2022:0418

  • vinyl-cache openSUSE Tumbleweed 9.0.0-1.1
  • varnish openSUSE Tumbleweed 7.1.0-1.1
  • varnish Package Hub 15 SP3, openSUSE Leap 15.3 7.1.0-bp153.2.3.1

opensuse advisories openSUSE-SU-2026:10751-1openSUSE-SU-2024:12086-1openSUSE-SU-2022:0148-1

  • varnish AlmaLinux 8 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1
  • varnish AlmaLinux 8 6.0.8-1.module_el8.5.0+76+a10ffa55
  • varnish-modules AlmaLinux 8 0.15.0-6.module_el8.5.0+2620+03a0c2cc
  • varnish-modules AlmaLinux 8 0.15.0-6.module_el8.5.0+76+a10ffa55

almalinux advisories ALSA-2022:0418

  • varnish Rocky Linux 8 6.0.8-1.module+el8.5.0+736+fec10e21.1
  • varnish Rocky Linux 8 6.0.8-1.module+el8.5.0+677+2a78a869
  • varnish-modules Rocky Linux 8 0.15.0-6.module+el8.5.0+677+2a78a869

rocky linux advisories RLSA-2022:0418

  • varnish Alpine 3.13, Alpine 3.12 6.5.2-r1
  • varnish Alpine 3.14 6.6.2-r0
  • varnish Alpine 3.24, Alpine 3.23, Alpine 3.22 +7 more 7.0.2-r0

alpine advisories ALPINE-CVE-2022-23959

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-23959 updated cvss 9.1

varnish: HTTP/1 request smuggling vulnerability

  • Red Hat Enterprise Linux AppStream (v. 8) varnish 6.0.8-1.module+el8.5.0+14089+03a0c2cc.1, varnish-modules 0.15.0-6.module+el8.5.0+11976+0b4af72d
    fixed: vendor fix RHSA-2022:0418
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) varnish 6.0.2-2.module+el8.1.0+14093+aa8ea65f.1, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
    fixed: vendor fix RHSA-2022:0420
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) varnish 6.0.2-2.module+el8.2.0+14091+b587eafb.1, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
    fixed: vendor fix RHSA-2022:0421
  • Red Hat Enterprise Linux AppStream EUS (v.8.4) varnish 6.0.6-2.module+el8.4.0+14090+331e4860.2, varnish-modules 0.15.0-5.module+el8.3.0+6843+b3b42fcc
    fixed: vendor fix RHSA-2022:0422
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-varnish6-varnish 6.0.8-2.el7.1, rh-varnish6-varnish-libs 6.0.8-2.el7.1 Red Hat Software Collections for RHEL(v. 7) rh-varnish6-varnish 6.0.8-2.el7.1, rh-varnish6-varnish-libs 6.0.8-2.el7.1
    fixed: vendor fix RHSA-2022:4745
  • Red Hat Enterprise Linux 9 varnish
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.01% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
OSV 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami varnish
>=7.0.0, <7.0.2
7.0.2

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.