CVE-2021-36740
Medium
Description
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Varnish-cache Varnish Cache
PublishedJul 14, 2021
First seenJul 14, 2021
How to fix
Update
- varnish-cache varnish_cache6.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| varnish-cache varnish_cache | 6.0.0 ≤ v < 6.0.8, 6.0.8 | 6.0.8 |
| varnish-software varnish_cache | 6.0.0 ≤ v ≤ 6.0.5, 6.0.0 ≤ v ≤ 6.0.7 | — |
| varnish_cache_project varnish_cache | 5.0.0 ≤ v ≤ 5.2.1, 6.1.0 ≤ v ≤ 6.6.0 | — |
| fedoraproject fedora | 33, 34 | — |
| debian debian_linux | 10.0, 11.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.