Description
Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | varnish | 7.5.0-1 | — |
| Debian 12 | varnish | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | varnish | No fix yet | — |
| Ubuntu 22.04 LTS | varnish | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | varnish +2 | 6.6.2-4.el9_3.1 | RHSA-2024:1691 |
| RHEL 8 | varnish +2 | 6.0.13-1.module+el8.9.0+21617+7578fa11 | RHSA-2024:1690 |
| RHEL 8 | varnish-modules | 0.15.0-6.module+el8.9.0+21617+7578fa11 | RHSA-2024:1690 |
| RHEL 3 | rh-varnish6-varnish +3 | 6.0.13-1.el7 | RHSA-2024:1689 |
| RHEL 3 | rh-varnish6-varnish-modules | 0.15.0-8.el7 | RHSA-2024:1689 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | varnish +2 | 6.6.2-3.el9_2.2 | RHSA-2024:2820 |
| RHEL 9.0 EUS | varnish +2 | 6.6.2-2.el9_0.3 | RHSA-2024:2700 |
| RHEL 8.8 EUS | varnish +2 | 6.0.8-3.module+el8.8.0+21796+79393093.2 | RHSA-2024:3305 |
| RHEL 8.8 EUS | varnish-modules | 0.15.0-6.module+el8.5.0+11976+0b4af72d | RHSA-2024:3305 |
| RHEL 8.6 EUS | varnish +2 | 6.0.8-2.module+el8.6.0+21852+17475f6a.3 | RHSA-2024:3426 |
| RHEL 8.6 EUS | varnish-modules | 0.15.0-6.module+el8.5.0+11976+0b4af72d | RHSA-2024:3426 |
| RHEL 8.4 TUS | varnish +2 | 6.0.6-2.module+el8.4.0+21799+2c737c67.5 | RHSA-2024:2938 |
| RHEL 8.4 TUS | varnish-modules | 0.15.0-5.module+el8.3.0+6843+b3b42fcc | RHSA-2024:2938 |
| RHEL 8.4 E4S | varnish +2 | 6.0.6-2.module+el8.4.0+21799+2c737c67.5 | RHSA-2024:2938 |
| RHEL 8.4 E4S | varnish-modules | 0.15.0-5.module+el8.3.0+6843+b3b42fcc | RHSA-2024:2938 |
| RHEL 8.4 AUS | varnish +2 | 6.0.6-2.module+el8.4.0+21799+2c737c67.5 | RHSA-2024:2938 |
| RHEL 8.4 AUS | varnish-modules | 0.15.0-5.module+el8.3.0+6843+b3b42fcc | RHSA-2024:2938 |
| RHEL 8.2 AUS | varnish +2 | 6.0.6-1.module+el8.2.0+22154+6b906702 | RHSA-2024:4937 |
| RHEL 8.2 AUS | varnish-modules | 0.15.0-4.module+el8+2481+4078e9d2 | RHSA-2024:4937 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | varnish +2 | 6.6.2-4.el9_3.1 | ALSA-2024:1691 |
| AlmaLinux 8 | varnish +2 | 6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1 | ALSA-2024:1690 |
| AlmaLinux 8 | varnish-modules | 0.15.0-6.module_el8.5.0+76+a10ffa55 | ALSA-2024:1690 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | varnish | 6.6.2-4.el9_3.1 | RLSA-2024:1691 |
| Rocky Linux 8 | varnish | 6.0.13-1.module+el8.9.0+1777+0acf9965 | RLSA-2024:1690 |
| Rocky Linux 8 | varnish-modules | 0.15.0-6.module+el8.5.0+677+2a78a869 | RLSA-2024:1690 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | varnish | 7.5.0-r0 | — |
| Alpine v3.23 | varnish | 7.5.0-r0 | — |
| Alpine v3.22 | varnish | 7.5.0-r0 | — |
| Alpine v3.21 | varnish | 7.5.0-r0 | — |
| Alpine v3.20 | varnish | 7.5.0-r0 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | varnish | 7.4.3-r0 | — |
| Alpine v3.18 | varnish | 7.3.2-r0 | — |
| Alpine v3.17 | varnish | 7.3.2-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | varnish +2 | 6.6.2-4.el9_3.1 | ELSA-2024-1691 |
| Oracle Linux 8 | varnish +2 | 6.0.13-1.module+el8.9.0+90264+d552af1c | ELSA-2024-1690 |
| Oracle Linux 8 | varnish-modules | 0.15.0-6.module+el8.9.0+90264+d552af1c | ELSA-2024-1690 |
Advisories 16
- ALSA-2024:1691 Important: varnish security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:1690 Important: varnish security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:4937 Red Hat Security Advisory: varnish:6 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3426 Red Hat Security Advisory: varnish:6 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:3305 Red Hat Security Advisory: varnish:6 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:2938 Red Hat Security Advisory: varnish:6 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:2820 Red Hat Security Advisory: varnish security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:2700 Red Hat Security Advisory: varnish security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:1690 Red Hat Security Advisory: varnish security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:1691 Red Hat Security Advisory: varnish security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2024:1689 Red Hat Security Advisory: rh-varnish6-varnish security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RLSA-2024:1691 Important: varnish security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:1690 Important: varnish security update Rocky Linux Security Advisories · Feb 4, 2026
- WID-SEC-2024-0701 Varnish HTTP Cache: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 18, 2024
- ELSA-2024-1690 Important: varnish security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 9, 2024
- ELSA-2024-1691 Important: varnish security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 9, 2024