Description
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | varnish | 7.1.1-1.1 | — |
| Debian 12 | varnish | 7.1.1-1.1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP4 | varnish | 7.2.1-bp154.2.9.1 | openSUSE-SU-2022:10198-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | varnish | 7.2.1-1.1 | openSUSE-SU-2024:12496-1 |
| openSUSE Tumbleweed | vinyl-cache | 9.0.0-1.1 | openSUSE-SU-2026:10751-1 |
| openSUSE Leap 15.4 | varnish | 7.2.1-bp154.2.9.1 | openSUSE-SU-2022:10198-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | varnish | 7.2.1-r0 | — |
| Alpine v3.23 | varnish | 7.2.1-r0 | — |
| Alpine v3.22 | varnish | 7.2.1-r0 | — |
| Alpine v3.21 | varnish | 7.2.1-r0 | — |
| Alpine v3.20 | varnish | 7.2.1-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | varnish | 7.2.1-r0 | — |
| Alpine v3.18 | varnish | 7.2.1-r0 | — |
| Alpine v3.17 | varnish | 7.2.1-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
martinvks/CVE-2022-45059-demo ★ 0 · Nov 12, 2023
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- WID-SEC-2022-2036 Varnish HTTP Cache: Mehrere Schwachstellen ermöglichen Manipulation von Dateien BSI CERT-Bund (WID) · Aug 26, 2026
- openSUSE-SU-2026:10751-1 libvinylapi3-9.0.0-1.1 on GA media SUSE / openSUSE Security Updates · May 12, 2026
- openSUSE-SU-2022:10198-1 Security update for varnish SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12496-1 libvarnishapi3-7.2.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://varnish-cache.org/security/VSV00010.html
- FEDORA-2022-babfbc2622 vendor-advisory
- FEDORA-2022-0d5dcc031e vendor-advisory
- FEDORA-2022-99c5ddb2ae vendor-advisory