Skip to content
Fencer Vulns
high 7.5

CVE-2024-30156 json

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaust…

published 2024-03-24 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-28092

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
3.7%
EPSS 3.7% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

Patch / fix

  • varnish Debian 13 7.5.0-1

debian advisories DEBIAN-CVE-2024-30156

  • varnish RHEL 9 6.6.2-4.el9_3.1
  • varnish RHEL 8 6.0.13-1.module+el8.9.0+21617+7578fa11
  • varnish-modules RHEL 8 0.15.0-6.module+el8.9.0+21617+7578fa11
  • rh-varnish6-varnish RHEL 3 SOFTWARE_COLLECTIONS 6.0.13-1.el7
  • rh-varnish6-varnish-libs RHEL 3 SOFTWARE_COLLECTIONS 6.0.13-1.el7
  • rh-varnish6-varnish-modules RHEL 3 SOFTWARE_COLLECTIONS 0.15.0-8.el7
  • varnish RHEL 8.2 AUS 6.0.6-1.module+el8.2.0+22154+6b906702
  • varnish-modules RHEL 8.2 AUS 0.15.0-4.module+el8+2481+4078e9d2

red hat advisories RHSA-2024:4937RHSA-2024:3305RHSA-2024:2938RHSA-2024:2820RHSA-2024:2700RHSA-2024:1691

  • varnish AlmaLinux 8 6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1
  • varnish-modules AlmaLinux 8 0.15.0-6.module_el8.5.0+2620+03a0c2cc
  • varnish-modules AlmaLinux 8 0.15.0-6.module_el8.5.0+76+a10ffa55
  • varnish-modules AlmaLinux 8 0.15.0-6.module_el8.6.0+3089+dac88e97
  • varnish AlmaLinux 9 6.6.2-4.el9_3.1

almalinux advisories ALSA-2024:1690ALSA-2024:1691

  • varnish Rocky Linux 9 6.6.2-4.el9_3.1
  • varnish Rocky Linux 8 6.0.13-1.module+el8.9.0+1777+0acf9965
  • varnish-modules Rocky Linux 8 0.15.0-6.module+el8.5.0+677+2a78a869

rocky linux advisories RLSA-2024:1691RLSA-2024:1690

  • varnish Alpine 3.18, Alpine 3.17 7.3.2-r0
  • varnish Alpine 3.19 7.4.3-r0
  • varnish Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 7.5.0-r0

alpine advisories ALPINE-CVE-2024-30156

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-30156 updated cvss 7.5

varnish: HTTP/2 Broken Window Attack may result in denial of service

  • Red Hat CodeReady Linux Builder (v. 9) varnish-devel 6.6.2-4.el9_3.1
    fixed: vendor fix RHSA-2024:1691
  • Red Hat CodeReady Linux Builder EUS (v.9.0) varnish-devel 6.6.2-2.el9_0.3
    fixed: vendor fix RHSA-2024:2700
  • Red Hat CodeReady Linux Builder EUS (v.9.2) varnish-devel 6.6.2-3.el9_2.2
    fixed: vendor fix RHSA-2024:2820
  • Red Hat Enterprise Linux AppStream (v. 8) varnish 6.0.13-1.module+el8.9.0+21617+7578fa11, varnish-modules 0.15.0-6.module+el8.9.0+21617+7578fa11
    fixed: vendor fix RHSA-2024:1690
  • Red Hat Enterprise Linux AppStream (v. 9) varnish 6.6.2-4.el9_3.1
    fixed: vendor fix RHSA-2024:1691
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) varnish 6.0.6-1.module+el8.2.0+22154+6b906702, varnish-modules 0.15.0-4.module+el8+2481+4078e9d2
    fixed: vendor fix RHSA-2024:4937
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) varnish 6.0.6-2.module+el8.4.0+21799+2c737c67.5, varnish-modules 0.15.0-5.module+el8.3.0+6843+b3b42fcc Red Hat Enterprise Linux AppStream E4S (v.8.4) varnish 6.0.6-2.module+el8.4.0+21799+2c737c67.5, varnish-modules 0.15.0-5.module+el8.3.0+6843+b3b42fcc
    fixed: vendor fix RHSA-2024:2938
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) varnish 6.0.8-2.module+el8.6.0+21852+17475f6a.3, varnish-modules 0.15.0-6.module+el8.5.0+11976+0b4af72d
    fixed: vendor fix RHSA-2024:3426
show 6 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) varnish 6.0.8-3.module+el8.8.0+21796+79393093.2, varnish-modules 0.15.0-6.module+el8.5.0+11976+0b4af72d
    fixed: vendor fix RHSA-2024:3305
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) varnish 6.6.2-2.el9_0.3
    fixed: vendor fix RHSA-2024:2700
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) varnish 6.6.2-3.el9_2.2
    fixed: vendor fix RHSA-2024:2820
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) varnish 6.0.6-2.module+el8.4.0+21799+2c737c67.5, varnish-modules 0.15.0-5.module+el8.3.0+6843+b3b42fcc
    fixed: vendor fix RHSA-2024:2938
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-varnish6-varnish 6.0.13-1.el7, rh-varnish6-varnish-libs 6.0.13-1.el7, rh-varnish6-varnish-modules 0.15.0-8.el7 Red Hat Software Collections for RHEL(v. 7) rh-varnish6-varnish 6.0.13-1.el7, rh-varnish6-varnish-libs 6.0.13-1.el7, rh-varnish6-varnish-modules 0.15.0-8.el7
    fixed: vendor fix RHSA-2024:1689
  • Red Hat Enterprise Linux 9 varnish-modules Red Hat Enterprise Linux 10 varnish, varnish-modules Red Hat Software Collections rh-varnish6-jemalloc
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
23 mo ago

Exploit prediction

3.66% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.