high 7.5

CVE-2022-45060 json

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1.

published 2022-11-09 4 y ago modified 2026-09-08 2 mo ago also BIT-varnish-2022-45060 , EUVD-2022-47982

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.3%; EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits: 0; none known

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

Patch / fix

fixed in 3 distros 7

bitnami varnish 6.0.11, 7.1.2, 7.2.1
varnish-software varnish_cache 6.0.11
varnish_cache_project varnish_cache 6.0.11, 7.1.2

debian ubuntu red hat opensuse almalinux rocky linux alpine

varnish Debian 13, Debian 12 7.1.1-1.1

debian advisories DEBIAN-CVE-2022-45060

varnish Ubuntu Pro 18.04 LTS 5.2.1-1ubuntu0.1+esm1
varnish Ubuntu Pro 20.04 LTS 6.2.1-2ubuntu0.2+esm1
varnish Ubuntu Pro 22.04 LTS 6.6.1-1ubuntu0.2+esm1

ubuntu advisories UBUNTU-CVE-2022-45060

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

varnish RHEL 8 6.0.8-2.module+el8.7.0+17239+94d153bd.1
varnish-modules RHEL 8, RHEL 8.6 EUS 0.15.0-6.module+el8.5.0+11976+0b4af72d
rh-varnish6-varnish RHEL 3 SOFTWARE_COLLECTIONS 6.0.8-2.el7.2
rh-varnish6-varnish-libs RHEL 3 SOFTWARE_COLLECTIONS 6.0.8-2.el7.2
varnish RHEL 9 6.6.2-2.el9_1.1
varnish RHEL 8.6 EUS 6.0.8-2.module+el8.6.0+17240+b7b5e45c.1
varnish RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS 6.0.2-2.module+el8.2.0+17242+97092129.2
varnish-modules RHEL 8.2 TUS, RHEL 8.2 E4S, RHEL 8.2 AUS +1 more 0.15.0-4.module+el8+2481+4078e9d2

red hat advisories RHSA-2022:8649 RHSA-2022:8650 RHSA-2022:8646 RHSA-2022:8647 RHSA-2023:0673 RHSA-2022:8643

vinyl-cache openSUSE Tumbleweed 9.0.0-1.1
varnish openSUSE Tumbleweed 7.2.1-1.1
varnish Package Hub 15 SP4, openSUSE Leap 15.4 7.2.1-bp154.2.9.1

opensuse advisories openSUSE-SU-2026:10751-1 openSUSE-SU-2024:12496-1 openSUSE-SU-2022:10198-1

varnish AlmaLinux 9 6.6.2-2.el9_1.1
varnish AlmaLinux 8 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1
varnish-modules AlmaLinux 8 0.15.0-6.module_el8.5.0+2620+03a0c2cc
varnish-modules AlmaLinux 8 0.15.0-6.module_el8.5.0+76+a10ffa55
varnish-modules AlmaLinux 8 0.15.0-6.module_el8.6.0+3089+dac88e97

almalinux advisories ALSA-2022:8643 ALSA-2022:8649

varnish Rocky Linux 8 6.0.8-2.module+el8.7.0+1094+66cdd070.1
varnish-modules Rocky Linux 8 0.15.0-6.module+el8.5.0+677+2a78a869
varnish Rocky Linux 9 6.6.2-2.el9_1.1

rocky linux advisories RLSA-2022:8649 RLSA-2022:8643

varnish Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 7.2.1-r0

alpine advisories ALPINE-CVE-2022-45060

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-45060 updated 2026-11-02 cvss 7.5

varnish: Request Forgery Vulnerability

Red Hat CodeReady Linux Builder (v. 9) varnish-devel 6.6.2-2.el9_1.1
fixed: vendor fix RHSA-2022:8643
Red Hat CodeReady Linux Builder EUS (v.9.0) varnish-devel 6.6.2-2.el9_0.1
fixed: vendor fix RHSA-2022:8644
Red Hat Enterprise Linux AppStream (v. 8) varnish 6.0.8-2.module+el8.7.0+17239+94d153bd.1, varnish-modules 0.15.0-6.module+el8.5.0+11976+0b4af72d
fixed: vendor fix RHSA-2022:8649
Red Hat Enterprise Linux AppStream (v. 9) varnish 6.6.2-2.el9_1.1
fixed: vendor fix RHSA-2022:8643
Red Hat Enterprise Linux AppStream AUS (v. 8.2) varnish 6.0.2-2.module+el8.2.0+17242+97092129.2, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
fixed: vendor fix RHSA-2022:8646
Red Hat Enterprise Linux AppStream E4S (v. 8.1) varnish 6.0.2-2.module+el8.1.0+17243+35307414.2, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
fixed: vendor fix RHSA-2022:8647
Red Hat Enterprise Linux AppStream E4S (v. 8.2) varnish 6.0.2-2.module+el8.2.0+17242+97092129.2, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
fixed: vendor fix RHSA-2022:8646
Red Hat Enterprise Linux AppStream EUS (v.8.4) varnish 6.0.6-2.module+el8.4.0+17241+96fc0d9c.3, varnish-modules 0.15.0-5.module+el8.3.0+6843+b3b42fcc
fixed: vendor fix RHSA-2022:8645

show 4 more

Red Hat Enterprise Linux AppStream EUS (v.8.6) varnish 6.0.8-2.module+el8.6.0+17240+b7b5e45c.1, varnish-modules 0.15.0-6.module+el8.5.0+11976+0b4af72d
fixed: vendor fix RHSA-2022:8650
Red Hat Enterprise Linux AppStream EUS (v.9.0) varnish 6.6.2-2.el9_0.1
fixed: vendor fix RHSA-2022:8644
Red Hat Enterprise Linux AppStream TUS (v. 8.2) varnish 6.0.2-2.module+el8.2.0+17242+97092129.2, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
fixed: vendor fix RHSA-2022:8646
Red Hat Software Collections for RHEL Workstation(v. 7) rh-varnish6-varnish 6.0.8-2.el7.2, rh-varnish6-varnish-libs 6.0.8-2.el7.2 Red Hat Software Collections for RHEL(v. 7) rh-varnish6-varnish 6.0.8-2.el7.2, rh-varnish6-varnish-libs 6.0.8-2.el7.2
fixed: vendor fix RHSA-2023:0673

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 18 mo ago (2025-05-01)

Exploit prediction

1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	varnish	>=5.0.0, <6.0.11 >=7.0.0, <7.1.2 >=7.2.0, <7.2.1	6.0.11 7.1.2 7.2.1

Classification

Weakness

CWE-20 Improper Input Validation

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/G6ZMOZVBLZXHEV5VRW4I4SOWLQEK5OF5/
vendor-advisory, web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/XGF6LFTHXCSYMYUX5HLMVXQH3WHCSFLU/
vendor-advisory, web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/M4KVVCIQVINQQ2D7ORNARSYALMJUMP3I/
vendor-advisory, web
debian.org /security/2023/dsa-5334
vendor-advisory, third-party-advisory, advisory
varnish-cache.org /security/VSV00011.html
mitigation, vendor-advisory, advisory
docs.varnish-software.com /security/VSV00011
mitigation, vendor-advisory, advisory
lists.debian.org /debian-lts-announce/2022/11/msg00036.html
mailing-list, third-party-advisory, advisory
nvd.nist.gov /vuln/detail/CVE-2022-45060
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary